I want to generate the monthly report for the past six months and need the count of failed logs for each month.
July Count 20
June Count 15
Jan Count 50.
But the search below is not giving correct the output, Is there any way to get the monthly count of failed logs for the past six months?
index=networksecurity Protocol=Radius signature =Failed_Attempts | stats count by date_month, date_year
index=networksecurity Protocol=Radius signature =Failed_Attempts earliest="-6mon@mon" latest="@mon" | timechart span=1mon count(signature) as Total
This should give you unique no of users count and total failed attempts by each month. You may need to change the user filed name as per your log data.
index=networksecurity Protocol=Radius signature=Failed_Attempts earliest=-6mon@mon latest=@mon|timechart span=1mon dc(user) AS Users_Count,count(signature) AS Total_Failed_Attempts
index=networksecurity Protocol=Radius signature=* earliest=-6mon@mon latest=@mon|timechart span=1mon dc(user) AS Users_Count,count(eval(signature="Failed_Attempts")) AS Total_Failed_Attempts