success vs failed graph

[muzeebm]

Hi, 

Below is the information from one of my logs. 

"Information","ajp-nio-127.0.0.1-8016-exec-642","11/24/20","13:30:14","CLIENT_URL","samlServices.processRequest: stuUserReturn: {""update_user_details"":1,""processByCf"":true,""USER_LOGIN"":""XXXXX@YYYY.org"",""userID"":""XXXXXXX"",""user_id"":XXXXX,""connection_name"":""XXXX"",""login"":""XXXXX@YYYY.org"",""userAttributes"":{""group_name"":""HR"",""telephone"":"""",""country"":1,""preferredLanguage"":"""",""login"":"""",""organisation"":""XXXXX English"",""last_name"":""XXXXXX"",""email"":""XXXX@YYYY.org"",""first_name"":""XXXX"",""company"":""XXXXX English""},""saml_id"":1,""loginStatus"":""success""}"

The last bit loginStatus"":""success" will be  loginStatus"":""failed" in case of failure. 

I want to create create a chart/dashboard where I can get number of success requests compared to failures over a period of time. eg 30 days

Can someone please help me sort this out. Thanks. 

M

[muzeebm · Accepted solution]

Thanks, looks like it worked. 👍 @ITWhisperer 

[ITWhisperer]

Try something like

| rex "loginStatus\"\":\"\"(?<loginstatus>[^\"]+)"
| timechart count by loginstatus