Came across a Splunk blog post that talked about percentage of failed logins for Box (http://blogs.splunk.com/2015/08/25/splunking-box-data-user-authentications/) and I've been trying to adapt it to percentage of failed logins for Windows and I have the following search:
index=winevt (LogonType=2 OR LogonType=7 OR LogonType=10) (EventID=4624 OR EventID=4625) | stats count by _time EventType IpAddress | timechart count by EventType limit=10 usenull=f | eval pct_failed=AUDIT_FAILURE/(AUDIT_FAILURE+AUDIT_SUCCESS)*100 | eval pct_failed=round(pct_failed,1) | rename pct_failed AS "% Failed"
For the visualization, I have a stacked column chart, but I'm not getting the line for the average like I see in the blog post. Any help would be appreciated.
here is how you get a chart overlay:
In search, you click on 'Format > Chart Overlay' and under 'Overlay' in the fields you select 'pct_failed'
In a dashboard, if you're editing panels, you'd click on the little painbrush (Format) and Chart Overlay, just as in the step above.
View solution in original post
Awesome - thx for the reply and information!