It seems that your suggestion now works much better.   Can you explain in details why the where-clause should be put after the stats count clause? When I tried to reverse their order, it didn't work as expected ... View more

Thanks for your suggestion! However it doesn't generate the expected results. I've also tweaked a bit as following,  index=bigip "Storefront_v243" | rex ".*Common:(?<sid1>.*?): New session from client IP (?<ip>.*?) \(ST.*\) at VIP 146.72.254.172" | rex "Common:(?<sid2>.*?): Username '(?<un>.*?)'" | rex "Common:(?<sid3>.*?): \| Start \(fallback\) .* ending is: Allow" | where un != "" AND sid1=sid2 AND sid2=sid3 | stats count latest(un) as user latest(ip) as ip by sid1 sid3 it didn't work either ... View more

index=bigip "Storefront_v243" | rex ".*Common:(?<sid>.*?): New session from client IP (?<ip>.*?) \(ST.*\) at VIP 123.45.78.172" | rex "Common:(?<sid>.*?): Username '(?<un>.*?)'" | rex "Common:(?<sid>.*?): \| Start \(fallback\) .* ending is: Allow" | where un != "" | stats count latest(un) as user latest(ip) as ip by sid I've tried to collect the usernames and IP addresses associated with all APM sessions whose policy result is Allow, however, the above mentioned search query didn't work as expected, for instance, it listed username from a Denied session   ... View more

 One silly question here, the execution result of index=bigip "Storefront_v243" will be piped into this regex  rex ".*Common:(?<sid>.*?): New session from client IP (?<ip>.*?) \(ST.*\) at VIP 123.45.78.172" the regex results will only contain any logging lines matching this pattern: ".*Common:(?<sid>.*?): New session from client IP (?<ip>.*?) \(ST.*\) at VIP 123.45.78.172" When these first RegExp matched results are piped to the next regex: | rex "Common:(?<sid>.*?): Username '(?<un>.*?)'" it should NOT match anything, shouldn't it? IMO, all the loggings lines matching "Common:(?<sid>.*?): Username '(?<un>.*?)'" have already been filtered out with the firstly above mentioned RegExp, right? ... View more

Thanks for your inputs. I've tried to follow your thoughts further by checking the Policy result associated with that particular APM Session ID should be Allow   Aug 21 07:17:52 ::ffff:10.0.49.14 notice apmd[14365]: 014902b8:5: /Common/Storefront_v243.app/Storefront_v243:Common:295d141a: | Start (fallback) | Client Pre-Check (Browser) | Logon Page(1) (fallback) | Domain Variable Assign (fallback) | AD Authentication (Successful) | RADIUS Auth (Successful) | Full Resource Assign (fallback) | Allow | Ending is: Allow   That is, I'd like to get statistics over username and IP address associated with Allow/Successful authentications. However, the following search query doesn't work as expected, because the username with failed APM Authentication was also returned.   Aug 21 17:27:04 ::ffff:10.0.49.14 notice apmd[14365]: 01490005:5: /Common/Storefront_v243.app/Storefront_v243:Common:2a904a10: Following rule 'fallback' from item 'AD Authentication' to ending 'Deny'   Aug 21 17:27:04 ::ffff:10.0.49.14 notice apmd[14365]: 01490010:5: /Common/Storefront_v243.app/Storefront_v243:Common:2a904a10: Username 'vsasvospush'     index=bigip "Storefront_v243" | rex ".*Common:(?<sid>.*?): New session from client IP (?<ip>.*?) \(ST.*\) at VIP 123.45.78.172" | rex "Common:(?<sid>.*?): Username '(?<un>.*?)'" | rex "Common:(?<sid>.*?): \| Start \(fallback\) .* ending is: Allow" | where un != "" | stats count latest(un) as user latest(ip) as ip by sid   ... View more

These concerned logs are generated by the external product, the F5 BigIP/APM module, for instance, This is the event my first search query operates on:   Aug 21 08:46:02 ::ffff:10.0.49.14 notice tmm1[21852]: 01490500:5: /Common/Storefront_v243.app/Storefront_v243:Common:aa8ccd2c: New session from client IP XX.XXX.88.248 (ST=Oslo/CC=NO/C=EU) at VIP 123.45.78.172 Listener /Common/Storefront_v243.app/Storefront_v243_webui_https (Reputation=Unknown) host = ::ffff:10.0.49.14 source = /var/log/remote/f5_ltm/::ffff:10.0.49.14/2023/08/21/syslog sourcetype = f5:bigip:apm:syslog   and the other event from BigIP/APM my second search query operates on: Aug 21 08:46:07 ::ffff:10.0.49.14 notice apmd[14365]: 01490010:5: /Common/Storefront_v243.app/Storefront_v243:Common:aa8ccd2c: Username 'john.smitch' host = ::ffff:10.0.49.14 source = /var/log/remote/f5_ltm/::ffff:10.0.49.14/2023/08/21/syslog sourcetype = f5:bigip:apm:syslog As you can see, the APM Session ID aa8ccd2c is the jointing key between these two events from the BigIP/APM ... View more

I've adjusted a bit: eval flag=case(like(regnr, "%mycompany%"), "MYCOMPANY",1=1,"PARTNERS") I can not use "else" or "default" in the case statement, therefore I've used the tricks/workaround: 1=1 as the default/else situations.   ... View more

it works well. Can you explain a bit how you've fixed it? ... View more