Security

LOGIN SUCCESS vs LOGIN FAILURE

MattQ
Explorer

I have logs that return the basic text of "LOGIN SUCCESS" and "LOGIN FAILURE" but I don't seem to be able to make this a unique and interesting field. I want to be able to search logs and return a count by IP addresses of everything trying to log in and then sort those with counts by SUCCESS or FAILURE

This seems incredibly simple but I am failing at it

Tags (1)
0 Karma
1 Solution

jtrucks
Splunk Employee
Splunk Employee

Use a field extraction like:

… | rex field=_raw ".*LOGIN\s(?<loginresult>(SUCCESS|FAILURE)).*"

There may be more elegant ways to do the regex, but that gives you the field named "loginresult" that will have either SUCCESS or FAILURE for each entry. That allows you to do reporting and matching on those fields. If the above works, then use that syntax to create a configured extract so the field is always available for that data source.

--
Jesse Trucks
Minister of Magic

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

Use a field extraction like:

… | rex field=_raw ".*LOGIN\s(?<loginresult>(SUCCESS|FAILURE)).*"

There may be more elegant ways to do the regex, but that gives you the field named "loginresult" that will have either SUCCESS or FAILURE for each entry. That allows you to do reporting and matching on those fields. If the above works, then use that syntax to create a configured extract so the field is always available for that data source.

--
Jesse Trucks
Minister of Magic

aelliott
Motivator
0 Karma

MattQ
Explorer

This definitely is breathing life into this. With this nudge I am getting there. Thank you

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Did you tried extracting LOGIN SUCCESS or LOGIN FAILURE using field extraction?

0 Karma

MattQ
Explorer

Here is a scrubbed version. Log Source and Sourcetype are defined and working well. LOGIN FAILURE looks exactly like LOGIN SUCCESS and is just plain text and doesn't return as an interesting field. The IP is out there and I can get a count to return by IP... but then I also want to see if these attempts have a SUCCESS or FAILURE associated.

<13>Nov 7 11:14:36 log source 07-Nov-2013 11:14:36 - LOGIN SUCCESS|User Attempt|0|IP list|xxx.xxx.xxx.xxx

Thank you

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Would you please provide sample log entries?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...