Creating Bar Chart for SSH logs

[akashjohn]

Hi Team,

We are trying to create a bar chart from secure log. The ultimate goal is to plot the accounts (top 10) used to login to maximum number of servers with count. i.e. the accounts which were used to log into multiple servers. From basic query we were are getting an output as shown below,

We are planning to plot server details (pup-ofc-mar-hjn-a) on X - Axis and users on Y - Axix. Could you please let us know how can we achieve this?

[gcusello · Accepted solution]

I think that you already loaded logs in an index (e.g.: secure_logs) and extracted the requested fields (user, account, etc...).
Than you have to write a search as the following
index=secure_logs | top users
or
index=secure_logs | stats dc(host) by users | head 10

Bye.
Giuseppe

[akashjohn]

Hi Giuseppe,

Thanks for the response. we can fetch the data with the quires, but here the requirement is to plot the accounts (top 10) used to login to maximum number of servers with count. i.e. the accounts which were used to log into multiple servers.

That means we need to fetch the users which are login to multiple servers and need to find the count of servers. The query which you have mentioned is not seems to be working in this case.

[gcusello]

with this search you have the number of distict server accessed by each user.

Sorry I forgot to insert sort!
index=secure_logs | stats dc(host) AS hosts by users | sort -hosts | head 10

Bye.
Giuseppe

[akashjohn]

Thanks Giuseppe, it seems to be working for me.