Failed Logins followed by Success Corp Wifi?

[ahmar74]

here is my string i just cant seem to figure out the x number of failures followed by success:

| tstats count values(Authentication.action) as Action, values(Authentication.user) as User, values(Authentication.Calling_Station_ID) as "MAC Address", values(Authentication.src) as Source from datamodel="Authentication"."Authentication" where (index=acs Authentication.action!=success Authentication.src!=10.242.*) by Authentication.user | brain freeze....

[wenthold]

I don't think tstats is the way to go since you're analyzing data in aggregate. You might want to look at the answer Woodcock posted earlier: https://answers.splunk.com/answers/368521/how-can-i-detect-a-successful-login-after-multiple.html

You could approximate it with tstats, but I don't believe you can account for consecutive events using tstats with something like:

| tstats `summariesonly` count as failure_count from datamodel=Authentication where Authentication.action=failure earliest=-4h@h latest=-5m@m by Authentication.user, Authentication.app, _time
| join type=left Authentication.user, Authentication.app, _time  [| tstats `summariesonly` count as success_count from datamodel=Authentication where Authentication.action=success earliest=-4h@h latest=-5m@m by Authentication.user, Authentication.app, _time]
| where failure_count>3 and success_count>1

.. but this won't account for the sequence of events, it will only find where they occur together, and any sequence spanning one of the time periods won't properly be accounted for.

[mmontgomery_spl · Accepted solution]

There are a few ways, but I like this one as it is a little simpler to modify for other use cases as well:

| from datamodel:"Authentication"."Authentication" | stats values(user) values(Calling_Station_ID) count(eval('action'=="success")) as success, count(eval('action'=="failure")) as failure by src | search success>1 failure>20