Hi,
I have an Aruba Controller SYSLOG example:
Apr 1 11:41:32 192.168.1.254 Apr 1 11:41:28 2015 Aruba3600 authmgr[1753]: <522008> User Authentication Successful: username=Alberta MAC=9c:f3:87:11:4f:a1 IP=192.168.0.18 role=authenticated VLAN=16 AP=HQ.12.11 SSID=TestSSID AAA profile=Guest-aaa_prof auth method=802.1x auth server=192.168.2.18
Apr 1 11:41:58 192.168.1.254 Apr 1 11:41:53 2015 Aruba3600 authmgr[1753]: <522008> User Authentication Successful: username=William MAC=a0:a8:cd:de:cf:3e IP=192.168.0.21 role=authenticated VLAN=16 AP=HQ.12.14 SSID=TestSSID AAA profile=Guest-aaa_prof auth method=802.1x auth server=192.168.2.17
Apr 1 11:42:12 192.168.1.254 Apr 1 11:42:08 2015 Aruba3600 authmgr[1753]: <522008> User Authentication Successful: username=Alberta MAC=54:9f:13:05:a3:4c IP=192.168.0.19 role=authenticated VLAN=16 AP=HQ.12.13 SSID=TestSSID AAA profile=Guest-aaa_prof auth method=802.1x auth server=192.168.2.11
Apr 1 11:42:14 192.168.1.254 Apr 1 11:42:11 2015 Aruba3600 authmgr[1753]: <522008> User Authentication Successful: username=Sabrina MAC=f0:dc:e2:79:5a:b7 IP=192.168.0.27 role=authenticated VLAN=16 AP=HQ.12.12 SSID=TestSSID AAA profile=Guest-aaa_prof auth method=802.1x auth server=192.168.2.37
Apr 1 11:42:24 192.168.1.254 Apr 1 11:42:21 2015 Aruba3600 authmgr[1753]: <522008> User Authentication Successful: username=Alberta MAC=9c:f3:87:11:4f:a1 IP=192.168.0.19 role=authenticated VLAN=16 AP=HQ.12.13 SSID=TestSSID AAA profile=Guest-aaa_prof auth method=802.1x auth server=192.168.2.18
my search syntax1
source="192.168.1.254" "User Authentication Successful" | stats count by username| sort limit=15 -num(count)
got result :
username Count
William 1
Alberta 3
Sabrina 1
my search syntax2
source="192.168.1.254" "User Authentication Successful" | stats list(MAC) as "MAC_Adddress" by username
got result :
username MAC_Address
William a0:a8:cd:de:cf:3e
Alberta 54:9f:13:05:a3:4c
9c:f3:87:11:4f:a1
Sabrina f0:dc:e2:79:5a:b7
How can I get a result like this:
username MAC_Address Count
------------ ------------------- --------
William a0:a8:cd:de:cf:3e 1
Alberta 54:9f:13:05:a3:4c 1
9c:f3:87:11:4f:a1 2
Sabrina f0:dc:e2:79:5a:b7 1
I want to know each device's successful authentication count by username. I am trying stuff, but somehow i cant find a way to search in one search two different count values..
... View more
