stats count sum

[kokanne]

Why does the following query not display the number of logins and logouts

(index="ggg-sec") EventCode=4624 OR EventCode=4634 
    [| inputlookup dfggfdf.csv] 
| stats count sum(EventCode = "4624") as LogIns, sum(EventCode = "4634") as LogOuts by user 
| fields - count 

Thanks

[kamlesh_vaghela · Accepted solution]

Hi @kokanne,

Can you please try it by replacing stats with this?

| stats count sum(eval(EventCode = "4624")) as LogIns, sum(eval(EventCode = "4634")) as LogOuts by user 

Like:

 (index="wineventlog-sec") EventCode=4624 OR EventCode=4634 
     [| inputlookup sv_externe_leveranciers.csv] 
| stats count sum(eval(EventCode = "4624")) as LogIns, sum(eval(EventCode = "4634")) as LogOuts by user 

Thanks

[kokanne]

do you know how to speed it up? @kamlesh_vaghela

it takes 34 minutes to run this query for last 24 hours, i need this to run every month for a monthly report

[amitm05]

You need to accelerate your report.
Mind that setting the schedule and time window for your acceleration should be according to your need.
E.g. If you want this report monthly for the last month.

I think you can probably set the acceleration schedule for last midnight of the day when you want this report. And set the time window of your search also to last month.

Please upvote if this helps you 🙂

[deepashri_123]

is there any reason for using lookup?

[kokanne]

for the user names

[kokanne]

Thanks, does exactly waht i want

[deepashri_123]

Hey kokanne,

Try this:
(index="wineventlog-sec") EventCode=4624 OR EventCode=4634
[| inputlookup sv_externe_leveranciers.csv]
|eval Condition=case(EventCode == 4624,"Logins",EventCode == 4634,"LogOuts") |stats count by Condition,user
Let me know if this helps!!

[kokanne]

Error in 'eval' command: The arguments to the 'case' function are invalid.

[deepashri_123]

I have edited, can you try now!!

[kokanne]

It works, but I would like instead of a column called "Condition", that the column is called either log in or log out, is that possible, and then also user and the count