Failed and Successful Authentication Attempts

Compare failed and successful authentication attempts by department. Useful for purposes such as authentication monitoring by department, security analysis, or for identifying problematic departments.

Bar Chart type: multiple series, grouped Bar Chart.

Sample input data:

auth_statusdepartmenttimestampuser
successIT2025-08-11T00:01:23Zadmin1
failedHR2025-08-11T00:01:24Zhr_user
successSales2025-08-11T00:01:25Zsales1
failedIT2025-08-11T00:01:26Ztech2
successHR2025-08-11T00:01:27Zhr_admin

Query:

logscale
groupBy([department, auth_status], function=count())
| sort(department)

Query breakdown:

  1. Group events by two fields: department and auth_status.

  2. Count events for each unique combination, showing how many events exist for each department/auth_status pair.

  3. Sort the results alphabetically by department name and groups all results for the same department together.

Visualization: X-axis displays the unique combinations of department and auth_status fields, for example "success HR". Each unique combination is represented as a separate bar on the chart. Y-axis represents the count of each unique combination of the two fields. The height of each bar corresponds to the number of occurrences for that particular combination.

Bar Chart showing use case of Authentication Attempts

Figure 208. Authentication Attempts


Configuration:

  1. From the Search page, type your query in the Query Editor → click Run

  2. Choose Bar Chart in the Widget selector

  3. Click the style icon : the side panel shows most settings already configured by default based on the query result. You may configure more settings manually, as follows.

  4. Set Title formatting to Medium

  5. Set the angle in Category axis to 45 degrees

  6. Assign a new title "events count" in Value axis (left)

  7. In Sorting, choose the option By series value for sorting by the fail series: this will overlap the default sorting assigned by the query.

  8. In Series formatting, customize labels and colors of the two authentication statuses.

    You can further customize this widget by setting more properties, see Bar Chart Property Reference.