topic range() function in Deployment Architecture

range() function

m_nouman — Sat, 20 Jan 2024 08:27:50 GMT

I want to search for an Account_Name that has the maximum number of login attempts within a span of 10 minutes with range() function.....

I don't know how can i provide the parameters to this function....

some help will be appreciated!

Re: range() function

PickleRick — Sat, 20 Jan 2024 08:56:07 GMT

And how did you come up with the range() stats function? This function is for something completely different - it tells you what's the difference between lowest and highest value in your result set whereas you want to count things. The range() function is completely unsuited for this.

You should be doing count by Account_Name. In order to make it over sliding window, you need to use streamstats with a proper time window.

<your_initial_search>
| streamstats time_window=10m count by Account_Name

This will give you counts of logins over 10 minute windows. From this you'll be able to pick the one with the highest count. For example with

| sort - count | head

Re: range() function

VatsalJagani — Mon, 22 Jan 2024 14:17:30 GMT

@m_nouman - You need to use time_window for streamstats command, as suggested by @PickleRick

For timechart and bin command use span=10m

I hope this helps!!!

Re: range() function

OzRL5 — Fri, 26 Apr 2024 15:47:11 GMT

from hackthebox academy it's one of their questions and the hint is to use the range() function