Hi, I want to group few events based on the success and failure action for a particular user and dest as below. Kindly help in writing a query like this. Using streamstats I got things like below. Query which I have used here index=wineventlog_sec* tag=authentication (action=success OR action=failure) | table _time user dest EventCode action | sort 0 _time user dest | streamstats count as attempts by action user dest reset_on_change=true Time User Dest action attempts T1 U1 D1 success 1 T2 U1 D1 success 2 T3 U1 D1 failure 1 T4 U1 D1 failure 2 T5 U1 D1 failure 3 T6 U1 D1 success 1 T7 U1 D1 success 2 T8 U1 D1 success 3 How to get the max attempts performed for a particular group of user dest and action (all 3 should be present) like below. Time User Dest action attempts max_attempts T1 U1 D1 success 1 2 T2 U1 D1 success 2 2 T3 U1 D1 failure 1 3 T4 U1 D1 failure 2 3 T5 U1 D1 failure 3 3 T6 U1 D1 success 1 3 T7 U1 D1 success 2 3 T8 U1 D1 success 3 3 ... View more

Hi, I want to check when the index was created, modified or deleted from internal logs(also other details of this particular operation). Is there any way to query this data? ... View more