Kibana Visualization - combine filters

Elastic Stack Kibana
1

Hello,

I'm trying to combine two filters together for a visualization, but it is not functioning correctly at all.
I wanted to combine: winlog.event_id:4723 and winlog.keywords:"Audit Success". When I do that, I'm getting a count of 53 events.

So I created a column for winlog.event_id:4723 which has a count of 1.
And one more column for winlog.keywords:"Audit Success" which has a count of 6.

So, if it were working correctly, that first filter should show a count of 7.

I haven't really found any recent posts about this, and perhaps I'm searching for the wrong thing. Is there any way I can solve this issue?

See screenshot for what the visualization looks like:

Issues
Issues2130×945 72.5 KB

2

As per my understanding you have to get a result with winlog event id:4728 and whose keywords are success.Remove whatever you have given in aggregation just set the Y axis to count and .Select Add filter which is on the top and put your first condition there

image

Then after this click on add filter and do the same with winlog.keywords:"Audit Success"

image

3

That's great, and that really was a very simple solution. Thank you for your help!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.