Having Problems with timechart's searching

[venterdaniel]

Hi,

I am trying to do a timechart which shows the amount of sessions opened/closed.
Where the Opened and Closed are 2 separate lines.

The Current search I have looks as follows:

index="main" ("session" ("closed" OR "opened") AND NOT "cron:session")
| timechart
count(eval("session opened")) AS Opened,
count(eval("session closed")) AS Closed


Now the problem I am having is that they both show as the same 'count' amount.
When I separate this timechart into 2 different charts it works fine.

The log looks as follows:

Oct 19 09:06:10 YYY sshd[16997]: pam_unix(sshd:session): session opened for user XXX by (uid=0)
Oct 19 09:02:07 YYY sshd[13684]: pam_unix(sshd:session): session closed for user XXX
Oct 19 08:57:13 YYY sshd[13684]: pam_unix(sshd:session): session opened for user XXX by (uid=0)
Oct 19 00:26:43 YYY sshd[8577]: pam_unix(sshd:session): session opened for user XXX by (uid=0)


Daniel

[jflomenberg · Accepted solution]

You first need to create a filed for open/closed using the field extractor workflow or by defining a regex. eval in count is generally used along the lines of

... | timechart count(eval(field="value"))

The way you have crafted your eval without a field is basically causing the search to perform an arbitrary evaluation that roughly evaluates to

... | timechart count(TRUE)

which I think is just counting everything

[venterdaniel]

thank you for the clarification on requiring a field extractor, i downloaded the 'Field Extractor' App which helped create the new field called session which can either be "opened", "closed", "failure;" or "pass;"
(it picked up a few fields from authentication as well but that is alright xD)

Current search which is working

index="main" ("session" AND NOT "cron:session")
| timechart
count(eval(session="opened")) AS Opened,
count(eval(session="closed")) AS Closed