I want to display all relevant information that is available for remote sessions per remote session. However this is contained in different logs that all have the same session_id. Suppose I gather those logs in a search via a single stream. For example like this:
[3 user=”x*” type=login OR type=logoff OR type=authentication_try having same session_id] as Stream
How can I access the individual logs included?
| fields Stream.type, Stream.col_ts, Stream.user or
| chart count() by Stream.user etc. doesn’t work.
Just showing the fields without grouping of same session_id is not the solution, since I cannot order fields and all session_ids are mixed.
Hope there’s a way. Best
Best answer by Gustav Elkjær RødsgaardView original