Splunk Search

Stats count from different sources

gnoellbn
Explorer

Hello,

I'm trying to show login stats from different sources by user. Those two sources d'on't show user with the same field (Nom_de_l_utilisateur and user).

This search shows "No results". If I display either one or the other it works but not both at the same time.

(source="WinEventLog:Security" "CategoryString=Ouverture/fermeture" "Type=Failure" Type="Failure Audit") OR (source=udp:514 eventtype="failed_login") | regex host!="[QqZzVv][0-9].*" | search NOT "FortiService" | stats count by Nom_de_l_utilisateur,user

Thanks in advance 🙂

Tags (2)
0 Karma
1 Solution

jonuwz
Influencer

replace :

stats count by Nom_de_l_utilisateur,user

with :

eval user=coalesce(Nom_de_l_utilisateur,user) | stats count by user

This sets user to the 1st non-null value of Nom_de_l_utilisateur or user.

The trick is to get the data you need in 1 field.

View solution in original post

0 Karma

jonuwz
Influencer

replace :

stats count by Nom_de_l_utilisateur,user

with :

eval user=coalesce(Nom_de_l_utilisateur,user) | stats count by user

This sets user to the 1st non-null value of Nom_de_l_utilisateur or user.

The trick is to get the data you need in 1 field.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...