Hi,
We use RSA Netwitness Logs & Network for DB logs reporting and have a field which indicates which type of activity is being performed e.g SELECT, UPDATE, DELETE etc.
How can we create a count and total the occurrence of each value, and possibly present this in a chart ?
Regards,
Balvin
Balvin
The aggregate functions can be used.
For example if you want to run a report for failed logins and count the username you could do something like the following:
select: username, action, count(username)
If you wanted to add up the amount of bandwidth a user consumed, you could do the following:
select: ip.src,sum(bytes)
There are other functions such as: min,max,first,last
Hope this helps
Dave