How to show search on condition - do not show or erase/delete on other condition?

[eholz1]

Hello All,

I have been searching for "how to" but not had much luck. I have this search: I run it realtime, and test with fixed time range (like 15 min,. etc)

sourcetype=linux_secure eventtype="ssh_open" OR eventtype="ssh_close" | eval Date=strftime(_time, "%Y-%m-%d %H:%M:%S")
| eval UserAction=case(eventtype="ssh_open","On",eventtype="ssh_close","Off",1==1,UserAction)
| stats last(UsaerAction) by Date,host,user,UserAction | sort - Date

This search gives me a user, a host, and a "on" if user logs on and an "Off" if user logs off.

I would like to not show the "Off" condition when the user logs off - i.e. make the "On" line in the search result go away (disappear)

How might I do this?

thanks for a great source of info,

eholz1

[yuanliu]

I'm unsure about the exact requirement.  Why would you need to groupby a field that you are seeking latest of?

sourcetype=linux_secure eventtype="ssh_open" OR eventtype="ssh_close" | eval Date=strftime(_time, "%Y-%m-%d %H:%M:%S")
| eval UserAction=case(eventtype="ssh_open","On",eventtype="ssh_close","Off",1==1,UserAction)
| stats last(UserAction) by Date,host,user | sort - Date
| where 'last(UserAction)' == "Off"

or, if you want the column name to be UserAction, use AS 

sourcetype=linux_secure eventtype="ssh_open" OR eventtype="ssh_close" | eval Date=strftime(_time, "%Y-%m-%d %H:%M:%S")
| eval UserAction=case(eventtype="ssh_open","On",eventtype="ssh_close","Off",1==1,UserAction)
| stats last(UserAction) as UserAction by Date,host,user | sort - Date
| where UserAction == "Off"

[eholz1]

Hello,

I am trying to hide or show a panel depending on a search result.

I have this search
sourcetype=linux_secure user=smith eventtype="ssh_open" OR eventtype="ssh_close" | eval Date=strftime(_time, "%Y-%m-%d %H:%M:%S")
| eval UserAction=case(eventtype="ssh_open","On",eventtype="ssh_close","Off",1==1,UserAction)
| stats last(UserAction) by Date,host,user | sort - Date
| where 'last(UserAction)' == "Off" OR 'last(UserAction)' == "On"

the search returns "On" or "Off" as the last "UserAction"

I have two panels, panel1 and panel2
If the search in panel1 gives "On" for the result for user "smith", I want to show panel2

then "smith" logs off...

then if I rerun the search in panel1 and it returns UserAction == "Off" I want to hide panel2

So far no luck in understanding match for the search result or eval for the search result

Here is my logic:

<table>
<search id="log_action">
<query>sourcetype=linux_secure user=holzapfele eventtype="ssh_open" OR eventtype="ssh_close" | eval Date=strftime(_time, "%Y-%m-%d %H:%M:%S")
| eval UserAction=case(eventtype="ssh_open","On",eventtype="ssh_close","Off",1==1,UserAction)
| stats last(UserAction) by Date,host,user | sort - Date
| where 'last(UserAction)' == "Off" OR 'last(UserAction)' == "On" </query>
<earliest>-15m@m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<progress>
<condition match="$result.last(UserAction)$==Off">
<set token="hide_panel">true</set>
<unset token="hide_panel"></unset>
</condition>
<condition match="$result.last(UserAction)$==On">
<set token="hide_panel">false</set>
<unset token="hide_panel"></unset>
</condition>
</progress>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>

I am not desiring to use any inputs here for a form, like drop downs, etc

I do know I am not understanding the use of the SimpleXML tags, etc. like <done> or result vs. job, etc

any suggestions will help,

Thanks Again,

eholz1

[yuanliu · Accepted solution]

Your code is almost there.  The only change you need is to use two tokens to turn on-off two panels.

<table>
<search id="log_action">
<query>sourcetype=linux_secure user=holzapfele eventtype="ssh_open" OR eventtype="ssh_close" | eval Date=strftime(_time, "%Y-%m-%d %H:%M:%S")
| eval UserAction=case(eventtype="ssh_open","On",eventtype="ssh_close","Off",1==1,UserAction)
| stats last(UserAction) by Date,host,user | sort - Date
| where 'last(UserAction)' == "Off" OR 'last(UserAction)' == "On" </query>
<earliest>-15m@m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<progress>
<condition match="$result.last(UserAction)$==Off">
<set token="show_panel1">true</set>
<unset token="show_panel2"></unset>
</condition>
<condition match="$result.last(UserAction)$==On">
<set token="show_panel2">false</set>
<unset token="show_panel1"></unset>
</condition>
</progress>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>

Note, the value of $show_panel1$ and $show_panel2$ doesn't matter.  All that matters is whether one or the other is set/unset.  After this, you create the other two panels with "depends" attribute with respective tokens as value like this

<panel depends=$show_panel1$>
  <title>this is panel 1</title>
  ...
</panel>
<panel depends=$show_panel2$>
  <title>this is panel 2</title>
  ...
</panel>

(See Show or hide content.)

[eholz1]

OK , Thanks Again,

I will review things, and give it a shot. 

I do appreciate the reponses - Next I realized I may have to do this row by row 🙂

eholz1

[eholz1]

Thanks

eholz1

[eholz1]

Hello

Thanks for the reply. I will check your revision and see what happens. I have also seen how to hide a dashboard panel, but cannot get that to work with way I want.

Thanks,

eholz