Alerting

Why is my search showing the total column value per user rather than individual results?

johann2017
Explorer

I want to create a report that alerts of 7 or more failed TACACS+ authentication attempts in the past 10 minutes. I almost got it working, except the "Total" column adds up every user that failed and totals it next to each username. So, for example, say I have two users: UserA failed 4 times and UserB failed 3 times. The Total column would show as 7 next to both UserA and UserB instead of 4 and 3. Below is my syntax:

index=cisco_ise Protocol=Tacacs AuthenticationResult=Failed Service=Login Type=Authentication | eventstats count as TOTAL_COUNT | stats latest(TOTAL_COUNT) as Total by user | where Total > 6

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

index=cisco_ise Protocol=Tacacs AuthenticationResult=Failed Service=Login Type=Authentication  | stats count by user | eventstats sum(count) as Total | where Total > 6
0 Karma

johann2017
Explorer

Hello there. Didn't work the way I wanted. The search is adding up the count for each user and totaling that up and if it totals to greater than 6 it alerts. For example, one user has 4 failed attempts and the other user has 3 failed attempts. No individual user is over 6 so I wouldn't want it to alert. However, since the total is 7 the search thinks its over 6 so it alerts. How can I make this for greater than 6 for an individual user only?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...