Hi, Folks. I'm sorry for necroing this post. I'm replying for other guys who would run into this question later. Ok, there seems to be a bit of misunderstanding on action field in index=_audit. There is a reason why we cannot do index=_audit action="login attempt" When you look closely the actual events: If the _raw says "... action=login attempt info=success ..." We get action=success If the _raw says "... action=login attempt info=failed ..." We get action=failure So, yeah... In short, we do have those "login attempt" actions. It's just that we have underlying evals indicating whether the login action is a success or a failure. Cheers.
... View more