We have our test environment in which Splunk Enterprise OVA is installed as server and Windows server (with universal forwarder installed) which is client. From these windows server all the logs are forwarder. I want to find the the consecutive failed logins events within the time span of 1 min. If a next event is successful logon in the middle of the failed logins, it should ignored. Each event has a field which tells whether it was success or failure.
For Ex: I have tried using the below query.
Any help to resolve this issue.
Thanks
above answer is not valid for consecutive failed attempts
Hi Sagar0511,
if you want all the failed login in a minute, you could use a search like this:
index=wineventslog EventCode=4625
| stats values (Account_Name) AS Account_Name values(dest) AS dest values(ComputerName) AS ComputerName count
If you want to know the login failed for each Account_Name you can add the clause BY at the end of the search
index=wineventslog EventCode=4625
| stats values (Account_Name) AS Account_Name values(dest) AS dest values(ComputerName) AS ComputerName count BY Account_Name
If instead a saccessful login resets the count you can use something like this:
index=wineventslog EventCode=4624 OR EventCode=4625
| transaction startswith="EventCode=4625" endswith="EventCode=4624"
| table Account_Name dest ComputerName eventcount
If a saccessful login resets the count and you want the count for user you can use something like this
index=wineventslog EventCode=4624 OR EventCode=4625
| transaction Account_Name startswith="EventCode=4625" endswith="EventCode=4624"
| table Account_Name dest ComputerName eventcount
Bye.
Giuseppe