Skip to content

Instantly share code, notes, and snippets.

@weirded
Created January 9, 2015 01:25
Show Gist options
  • Select an option

  • Save weirded/83680cff8cfc356e69a4 to your computer and use it in GitHub Desktop.

Select an option

Save weirded/83680cff8cfc356e69a4 to your computer and use it in GitHub Desktop.
Query 2
error
| parse “ip=*, errorcode=*“ as ip, errorcode
| where errorcode=”failed_login”
| lookup ip from /my/whitelisted_ips on ip=ip
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment