I have logs like of this form:
[2021-08-19T13:59:05.607] [INFO] collect - [4a2b9170-0130-11ec-95b3-17c017e0ec5d] {"uid":967,"ec":"login","em":"Successful authentication with username: [test123] other data here..."
[2021-08-19T13:59:05.607] [INFO] collect - [4a2b9170-0130-11ec-95b3-17c017e0ec5d] {"uid":967,"ec":"login","em":"Successful authentication with username: [test123] other data here..."
I would like to run a query that will show all the cases where "username: [specific user]" shows up within 1 second. So the two lines above would be a hit because the test123 appeared in two similar events 1ms apart.
I have gotten this far:
source="my.log"
| rex field=_raw "Successful authentication with username: \[(?<username>.*)] "
| streamstats count time_window=1s by username
| where count > 1
But this doesn't take the value of username into account and returns all cases of "Successful authentication.." that happen to be within the same second. (Again I want that *only* if the username field is the same.)
Thanks!
- Henrik
Try this instead
source="my.log"
| rex field=_raw "Successful authentication with username: \[(?<username>.*)] "
| bin span=1s _time as second
| eventstats count by second username
| where count > 1
Try this instead
source="my.log"
| rex field=_raw "Successful authentication with username: \[(?<username>.*)] "
| bin span=1s _time as second
| eventstats count by second username
| where count > 1
That worked great! Thank you so much for the fast reply!
- Henrik