NW rules: Creating a Graphic

[RenatoGoncalves]

Hello,

I need help in creating a report in NW

I want to creat a graph that contais both sucess and failed logins. I tried this: 

event.cat.name contains 'Failed' && event.cat.name contains 'Sucess' && lc.cid = 'inf-logcollector01','inf-logcollector02' and this  (event.cat name contains 'Failed' && event.cat.name contains = 'Sucess') && (lc.cid = '1','2') but i cannot obtain results.

If i try with just one of the results, in the case Failed, it gives me results.

Anyone has an idea how to put the data to obtain results? 

[Anonymous]

Try using an OR query instead of an AND query. Currently your query is looking for events that are both login failures and login successes at the same time. Also, try and be more specific with your query - CONTAINS is a very expensive operator. Use EQUALS whenever possible.

ec.activity = 'logon' && ec.outcome = 'success','failure'

[RenatoGoncalves]

Hello Chris

Thank you. That was very helpful