How to display the number of failures, plus earliest(_time) and latest(_time) by src_ip?

[mikefoti]

Given web access log data with following fields:

_time,  http_status, src_ip, dest_ip

After a bruteforce attack on a login page, where http_status of 200=success and 401=failure, how can I display the number of failures, plus earliest(_time) and latest(_time) by src_ip

I've tried using streamstats like below, but do not get what I'm looking for

index=myIndex AND status=*
| table _time status src_ip dest_ip
| sort + _time
| streamstats reset_on_change=true count earliest(_time) AS ET latest(_time) AS LT by status
| convert ctime(ET) ctime(LT)

[ITWhisperer · Accepted solution]

index=myIndex AND status=*
| table _time status src_ip dest_ip
| sort + _time
| stats count(eval(status="401")) as count earliest(_time) AS ET latest(_time) AS LT by src_ip