I want to find the ratio of failures and successful logins. Therefore I use one field in a data model, called Authentication.action. I'm using tstats.
I get two results, in a table.
Authentication.action - count
failure - 7511212
success - 1010802549
I want to use these results in an eval command to divide them between each other and find the ratio of successful logins to every failed login.
Is this possible?
hi @kokanne
try like this
if it is helpful pls accept this
|makeresults |eval Authentication="failure" ,count=7511212 | append [|makeresults |eval Authentication="success" ,count=1010802549 ] |table Authentication count
|transpose header_field=Authentication |eval division=success/failure |transpose column_name=Authentication
hi @kokanne
try like this
if it is helpful pls accept this
|makeresults |eval Authentication="failure" ,count=7511212 | append [|makeresults |eval Authentication="success" ,count=1010802549 ] |table Authentication count
|transpose header_field=Authentication |eval division=success/failure |transpose column_name=Authentication
Also, these results are not always the same, so the hardcoded count value wouldn't work out
@kokanne
just add that snippet code at end of your query
I see, how can I get the single value of the eval output?
@kokanne
just add |table columnname (which fields you want to display)
| tstats summariesonly=true count from datamodel=Authentication by "Authentication.action"
| search "Authentication.action"!="unknown"
| transpose header_field=="Authentication.action"
| eval division=success/failure
Trying to only display division field, table division doesn't work
Edit: Found out what the problem was, it's fixed
Makeresults has to be the first command in the query, but that is already being used by tstats
@kokanne
makeresults
command is just for generating data for sample search.
just try this.
YOUR_TSTATS_SEARCH
|transpose header_field=="Authentication.action" |eval division=success/failure
OR
YOUR_TSTATS_SEARCH
|transpose header_field=="Authentication.action" |eval division=success/failure |transpose column_name=Authentication