report only specific eventtypes

[EricPartington]

I would like to report only on specific eventtypes.

I have a search that returns the eventtypes that i want to chart vs. each other (firewall-accept vs firewall-deny). But I also have a number of other eventtypes that apply to this data that also show up in this search (eventtype=cisco_firewall)

How can I only show the two eventtypes that I care about in the timechart (accept vs deny)

[stollefsen]

Neither 2 options worked for me in version 6.x.x. Interesting. I went back and disabled the one eventtype, I needed removed in my dashboard.

[mw · Accepted solution]

Your search could either look something like:

(eventtype="firewall-accept" OR eventtype="firewall-deny") other search terms | timechart count by eventtype

or it could filter to the eventtypes

... | eval a=mvfilter(eventtype == "firewall-accept" or eventtype == "firewall-deny") | search a=* | timechart count by a

The first would probably be the cleanest way, if you're able to use either method.

[mfscully]

Second option solved my problem as well! Thanks!

[klaurean]

I had this same problem and the second option was perfect. Thank you!

[EricPartington]

The second query works like a charm, thanks