Good morning,
I have a search that looks through and Oracle database for an ACTION_NAME:
source="dbx:[DB source]" sourcetype="oracle:audit:trail" USERNAME!=SYS AND ACTION_NAME=LOGON
Those events also include a RETURNCODE which defines if it was a successful logon. For example if the ACTION_CODE=LOGON and RETURNCODE=0, then it was a successful login. If ACTION_CODE=LOGON and RETURNCODE!=0, then it was a failed logon. How can I build a table that displays the RETUNRCODE as a text value of "Failed" or "Successful" based on the RETURNCODE value of 0 or <>0?
Any help would be appreciated. Thanks.
You can add the following to your query
| eval LogonStatus = if (RETURNCODE==0, "Successful", "Failed")
After that you will have a new field LogonStatus
that you can use in your table as you see fit.
You can add the following to your query
| eval LogonStatus = if (RETURNCODE==0, "Successful", "Failed")
After that you will have a new field LogonStatus
that you can use in your table as you see fit.
Thank you! That is exactly what I am looking for! Much Appreciated.