I am creating a dashboard for failed login, however, in the table created, there will be rows with all "" as values- How can I eliminate them? I have tried | fillnull value=("NA" OR "") but didn't work. dproc=sshd categoryOutcome=/Fail* (src=* OR shost=* OR dvc=* OR dvchost=* OR suser=* OR duser=* OR msg=*)| table _time src shost dvc dvchost suser duser msg | fillnull value="NA" |top 20 _time src shost dvc dvchost suser duser msg ... View more

What types of dashboard (which specific information to consider) when dealing w/ closed network monitoring (i.e. not connected to the Internet)? This is for an Enterprise system with several users. Failed logins/SSHD have been taken into account. Thanks! ... View more

Thank you for coming by a few weeks ago. I am trying to create Dashboard for failed login- however since we are getting data from multiple sources, i.e. syslog, CEF, etc.. we don’t have the same fields in the results. For example- I am trying to create a table that display failed login results for all sshd processes (and they come from different type of sources- ie. Some may have suser field, some may not, and what I have realized is that the result will only display those with “src shost dvc dvchost suser duser msg”, where the fields are empty it will omit them. Hence I am missing events. dproc=sshd categoryOutcome=/Fail*|top 20 categoryOutcome src shost dvc dvchost suser duser msg I hope I make sense. Please let me know if you have any questions/what I need to change? ... View more