- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How would i combine the two outputs?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm trying to use the stats function to list out values in a field
In the 1st image, I have the following search:
type=USER_AUTH res=failed | dedup _raw | stats count as "Failed attempts", values(dest) as "Failed on servers" by acct
http : //postimg . org/ image/ 714eq18rn/
How would i get the number of times the user failed to login to each server along with the server name?
For example, i click on the 1st user and the field shows me this
http : //postimg .org/ image/ cx4yifa8h/
(The values are actually server names)
I would like to have an output like this
acct Failed attempts Failed on servers
1 acct1 15 server1 (5)
server2 (5)
server3 (2)
and so on.
Does anyone know how i would get this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try following
type=USER_AUTH res=failed | dedup _raw | stats count by acct, dest | eval dest=dest." (".count.") | stats sum(count) as "Failed attempts", values(dest) as "Failed on servers" by acct
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yup, it's been resolved. Thank you though!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Failed attempts for acct1 should be 12, right?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try following
type=USER_AUTH res=failed | dedup _raw | stats count by acct, dest | eval dest=dest." (".count.") | stats sum(count) as "Failed attempts", values(dest) as "Failed on servers" by acct
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad I could help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Wow, thank you!
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
