1 Search with two results

[jcrensh]

I have a saved search returns the number of failed logins to a domain over a 24 hour period.

source="wineventlog:security" ("EventCode=4625") OR ("EventCode=529") host=dc*snlnt | stats count by host | rename count as "Unsuccessful Logins" | sort "Unsuccessful Logins"

That produces the following:

Host Unsuccessful Logins
MachineA Total_MachineA
MachineB Total_MachineB (and so on)

What I want to do is now add another running total of event id's 4624 and 528 as "Successful Logins" to the same search and produce the following:

Host Unsuccessful Logins Successful Logins
MachineA Total_MachineA Total_MachineA
MachineB Total_MachineB Total_MachineB (and so on)

It would be nice to have a way of determining the average per day over the last 7 days per host, but I am not sure what to do when you have a day with a higher than normal Unsuccessful or Successful count - that would then throw off your average over 7 days.

Thanks in advance,

Jason

[jcrensh]

Thank you very much, this worked like a champ.

[eelisio2 · Accepted solution]

The following will give you both results in the same search in descending order by Unsuccessful Logins.

source="wineventlog:security" host=dc*snlnt | stats count(eval(EventCode="4625" OR EventCode="529")) as "Unsuccessful Logins", count(eval(EventCode="4624" OR EventCode="528")) as "Successful Logins" by host | sort -"Unsuccessful Logins" | table host "Unsuccessful Logins" "Successful Logins"