Hello community!
I want to extract data from 2 different logs like bellow:
Log 1: 2024-04-28 06:38:51 INFO Start auth for accountId=1, ip=192.168.1.1
Log 2: 2024-04-28 06:38:27 INFO Collect response for accountId=1, was: response=FINISH
For example for accountId=1 I have 10 logs with "Start auth", I mean 10 attempts of start auth.
In second log, for the same accountId I have 1 or more logs with FINISH.
I want to make a table like
accountId Start auth FINISH
1 10 1
Could you helm me with this?
Thank you.
Have you already extracted accountId and response? If response does not have any value (null) does the event come from log1? If so, you could try something like this
| eval state=coalesce(response, "Start auth")
| chart count by accountId state
It works, thank you very much. One more thing, time filter isn't work, I mean if I set for 24H, search return logs for all time
This is a different question. Please start a new question with as much detail as possible.
Have you already extracted accountId and response? If response does not have any value (null) does the event come from log1? If so, you could try something like this
| eval state=coalesce(response, "Start auth")
| chart count by accountId state