Aggregate data view but with time of last entry

Follow

Kenneth Ord

• February 15, 2019 15:57

I want to list the number of times that users have failed to log into my web server in the past 24 hours, and the reason why. I can that pretty easily by parsing the message and counting on the usernames and error codes. However, I also want to the aggregate output to report the last time the user failed to login. I can see the "last" function but I can't work out if I can use it for this. Any help, please? 

0

• 

  Colby Hansen

  • February 22, 2019 18:47

  Perhaps: https://help.sumologic.com/05Search/Search-Query-Language/aaGroup/most-recent-and-least-recent
  
  

   

  0

  Comment actions Permalink
• 

  Azriel Nguyen

  • February 26, 2019 18:36

  you can try adding

  before query:

  | formatDate(_messageTime, "MM/dd/yyyy HH:mm:ss:SSS") as loginDate

  after query:
  | sort by loginDate desc

   

  just make sure to add loginDate to your count

  hope this helps

  0

  Comment actions Permalink

Please sign in to leave a comment.