topic Re: Splunk counting duplicate events for failed logon in Splunk Enterprise

Splunk counting duplicate events for failed logon

bayman — Tue, 29 Sep 2020 15:53:24 GMT

When the below search is ran, it'll count duplicate failed logons for all users. How do I exclude duplicates in a count?

eventtype=msad-failed-user-logons
(host="*")|fields
_time,signature,src_ip,src_host,src_nt_host,src_nt_domain,user,Logon_Type|stats
count by
user,src_nt_domain,src_ip,|sort
-count|rename user as "Username", src_nt_domain as "Domain", src_ip as
"IP Address"

Re: Splunk counting duplicate events for failed logon

DalJeanis — Tue, 19 Sep 2017 23:56:00 GMT

Try this -

eventtype=msad-failed-user-logons (host="*")
| fields_time, signature, src_ip, src_host, src_nt_host, src_nt_domain, user, Logon_Type
| dedup signature
| stats count by user, src_nt_domain, src_ip,
| sort - count
| rename user as "Username", src_nt_domain as "Domain", src_ip as "IP Address"

Based on the assumption that the dups will have the same signature.

Re: Splunk counting duplicate events for failed logon

lfedak_splunk — Wed, 20 Sep 2017 19:48:15 GMT

Hey @bayman, if @DalJeanis's solution worked then please don't forget to accept their answer to award karma points and close the question. 🙂

Re: Splunk counting duplicate events for failed logon

bayman — Wed, 20 Sep 2017 20:26:18 GMT

I dedup _time instead and it seemed to work better. Thanks

Re: Splunk counting duplicate events for failed logon

DalJeanis — Wed, 20 Sep 2017 23:50:55 GMT

@bayman - thanks for letting us know what worked. Interesting that the signature might be different between two duplicate events. Must mean something different from what I was guessing.