Splunk Search

After upgrading from Splunk 5 to 6.2.4, why is our search on failed login attempts from Windows Event Logs no longer working?

keithcoyle
New Member

We were using an old version of Splunk (ver 5) and have since updated to the ver 6.2.4 and now our failed login attempts search string no longer works and I can't figure out why. Here is what we have:

source="WinSecurity" "EventCode=4776" AND "Audit Failure" NOT (Logon_Account="*$" OR Logon_account="*$") | eval "User_Account" = coalesce(Logon_Account,Logon_account) 
| stats count by User_Account |sort 20 -count | search count > 15

We have several domain controllers and used to get all of the logs. Now I get nothing and it was working before. The only thing I think I see is that there is no longer a field called User_Account. I have played around with it, but it won't show me the search count by user anymore. What am I doing wrong? Thanks Keith

0 Karma

tskinnerivsec
Contributor

The inputs.conf format for Windows eventlogs changed from splunk v5 to splunk v6. Did you uprade the version of the UF on your domain controller? If so, you'll have to use the new inputs.conf format on them which is included in the newest Splunk_TA_windows.

0 Karma

jensonthottian
Contributor

Do you get any result after just putting :

source="WinSecurity" "EventCode=4776"

If not please that means you need to provide an index name.
Refer this - http://answers.splunk.com/answers/71694/search-without-index-not-working.html

0 Karma

keithcoyle
New Member

Yes I get 6K results, but I want to see just the ones that are over 15 times in a hr

0 Karma

jensonthottian
Contributor

add as - for hourly buckets
|bucket _time span=1h |

Also if this filed is not available "User_Account", on which field do you want the stats to run?

0 Karma

jensonthottian
Contributor

If the field is not available, extract it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...