Hi all, i count the number of ssl-login-fail for each hour. index... host... action="ssl-login-fail" | timechart span=1h count(eval(action="ssl-login-fail")) as result It's interesting but i would like to have change's rate in order to make alert if this rate change too much (>50% maybe). I tested lot of thing but i'm lost... Thanks a lot. ... View more

Hello all, i'm sure tje answer exists somewhere but i can't find it... As you can see, i start with this powerfull tool, and i need help. I have logs with FIELD1 and FIELD2 which concern the samething (IP ADDRESS). I need to chart a count of each line of log where FIELD1="A" OR FIELD2="B" in a bargraph by FIELD1 and FIELD2. So to see count of log by IP Address (which are in two differents fields. I hope i'm understandable... I stoped here (that display only count for the field i count by)... index="XXX" FIELD1="A" OR FIELD2="B" | chart count(eval(FIELD1="A")) AS "AnswerA", count(eval(FIELD2="B")) as "AnswerB" by ???   Many thanks! ... View more