I have a small environment.  I have 3 users that are allowed to login to a particular server.  If I search: index=<index name>  user=<username>  OR user=<username> OR user=<username> I find all instances of them logging in.  How can I find users that are not equal to those 3 users?  I want to set up an alert that will let me know when someone other than those 3 are trying to log in. ... View more

I want to add more columns that will show the sessions.  Such as sudo su ssh etc.  Currently I have this: index="name of index" user=* | chart count by user, action | sort user Maybe I need two separate searches?  One for action=failure and another for action=success?  I'm trying to breakdown what the totals are for success and failures.  Specifically I'd like to know when ssh sudo and su are being used. ... View more