Hi, I'm trying to detect brute force activity by detecting multiple auth failures followed by success.  I started with the following search which works and shows when there has been over 20 failures and at least 1 success, but the success can happen anywhere during the search period. It could be 1 success followed by 20 failures or the success can happen in the middle. index=main sourcetype="wineventlog" (EventCode=4624 OR EventCode=4625) Logon_Type IN (2,3,8,10,11) user!=*$ | bin _time span=5m as Time | stats count(eval(match(Keywords,"Audit Failure"))) as Failed, count(eval(match(Keywords,"Audit Success"))) as Success, count(eval(match(lower(Status),"0xc0000224"))) as "PwChangeReq", count(eval(match(lower(Sub_Status),"0xc0000071"))) as "Expired", count(eval(match(lower(Status),"0xc0000234"))) as "Locked" by Time user src_ip | where Success>0 AND Failed>=20 AND PwChangeReq=0 AND Locked=0 AND Expired=0   I need the query to only trigger if the success happens after 20 failures. I found some examples using streamstats so I created the following search but it's not working properly because the *reset_after* clears the failure_count for all src_ip. Therefore as long as there is 1 success from any IP address, the failure_count gets reset and I'm not seeing the failure count reach 20.   index=main sourcetype="wineventlog" EventCode IN (4624,4625) Logon_Type IN (2,3,8,10,11) | eval action=if(match(Keywords,"Audit Failure"),"failed","success") | reverse | streamstats window=0 current=true reset_after="("action==\"success\"")" count as failure_count by src_ip | where action="success" and failure_count > 20 | table _time, user, src_ip, action, failure_count   Is streamstats the way to go? Or how can I setup a query to detect the success after more than 20 failures? ... View more

Hi, I'm creating a report with the following search that runs each month covering the past 3 months of data. It works and I can display the results in a bar chart but it gets sorted alphabetically by sourcetype.    index=* | timechart span=1mon count by sourcetype | eval _time = strftime(_time,"%B") | rename _time as Time | fields - _* | transpose header_field=Time column_name="sourcetype"   I want to sort it by count of last month. So for example if I run the report in July I get columns "sourcetype", "April", "May", "June". Each month that I run the report the column names will change. I can get the results I want this month  by adding:   | sort - "June"   How can I set this up automatically  so that the results are sorted by the last column (previous month)? ... View more

Hi, I have a dashboard with a panel where I'm showing a table of triggered alerts: | table _time, ss_name, severity | sort - _time | rename ss_name AS "Alert Name", severity AS "Severity" When a user clicks on the alert name, the dashboard populates a drill down pane. <drilldown> <condition field="Alert Name"> <set token="show_panel">true</set> <set token="selected_value">"$click.value2$"</set> <set token="selected_value_latest">$click.value$</set> <eval token="selected_value_earliest">relative_time($selected_value_latest$, "-15m")</eval> <eval token="converted_time">strftime($selected_value_latest$, "%Y-%d-%m %H:%M")</eval> </condition> <condition> </condition> </drilldown> and I'm using the converted_time token to show the user the time of the alarm they clicked. <panel> <table> <title>[Drilldown] Recent statistics for $selected_value$ at $converted_time$</title> The issue I have is that this converted_time is showing an offset time. From what I gather it's showing the time in the local computer timezone (e.g. GMT -6 where the user is logged in from) even though the user's Splunk preference is set to GMT -5. I do not want to show the time in the user's timezone but rather in GMT -5. If I run strftime in a search, e.g.: | eval converted_time= strftime(_time, "%Y-%d-%m %H:%M") | table _time converted_time The converted_time column shows the time correctly matching the _time column. But when I use strftime in the dashboard: <eval token="converted_time">strftime($selected_value_latest$, "%Y-%d-%m %H:%M")</eval> I'm getting a different result. How can I fix this? ... View more

I've got the following search to identify when a user has more than 20 auth failures. I'm trying to find a way to remove additional logs of users who have less than 20 auth failures from the Events tab. For example, I might see in the Statistics tab 1 result indicating that a single user failed 135 times. However in the Events tab I see 145 logs which include 10 additional auth failures of other users that failed less than 20 times. I only want to see 135 logs in the Events tab corresponding to the 135 results from "| search TotalAuthFailures >= 20". This is so when analysts are drilling down on the alert they're not confused by additional users in the Events raw logs. How can I do this? index=main sourcetype="wineventlog" EventCode=4625 (Sub_Status=0xC000006A OR Sub_Status=0xC0000064) | eval match=if(match(Account_Name,".*\$"),1,0) | eval Description=if(Sub_Status=="0xC0000064","User name does not exist.","User name is correct but the password is wrong.") | where match=0 | stats count by user,src_ip,src_nt_host,Description | rename count AS "TotalAuthFailures" user AS "User (Origin)" src_ip AS "Source IP Address" src_nt_host AS "Host (Origin)" EventCode AS "Event ID" | dedup "User (Origin)" | search TotalAuthFailures >= 20 ... View more