https://community.splunk.com/t5/Getting-Data-In/Windows-Failed-Login-Top-Ten-count/m-p/127597#M26229 <P>Does the rex work if you don't use eval? If yes then you can try moving eval after rex.</P> <P>Another option you can try is to that instead of eval USER, use '|rename User_Name as Account_Name | ...| stats count by Account_Name'.</P> Mon, 28 Sep 2020 16:21:43 GMT somesoni2 2020-09-28T16:21:43Z https://community.splunk.com/t5/Getting-Data-In/Windows-Failed-Login-Top-Ten-count/m-p/127596#M26228 <P>I am trying to get the top 10 Failed Login count by User. The problem is that Windows 2008 uses "Account_Name" and Windows 2003 uses "User_Name" so I've used eval to combine the two fields but I am also using rex to go to the second instance of the Account_Name in the Windows 2008 event. The rex expression doesn't seem to work when I throw eval in there. Below is my search string, any suggestions?</P> <P>source="WinEventLog:Security" EventCode="4625" OR EventCode="529" |eval USER=coalesce(Account_Name,User_Name) | rex "(?ms)Account For Which Logon Failed.+?Account Name:\s+(?<SECOND_ACCOUNTNAME>\V+)" |stats count by USER |sort -count |head 10</SECOND_ACCOUNTNAME></P> Mon, 28 Sep 2020 16:21:37 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Failed-Login-Top-Ten-count/m-p/127596#M26228 aberdamy 2020-09-28T16:21:37Z https://community.splunk.com/t5/Getting-Data-In/Windows-Failed-Login-Top-Ten-count/m-p/127597#M26229 <P>Does the rex work if you don't use eval? If yes then you can try moving eval after rex.</P> <P>Another option you can try is to that instead of eval USER, use '|rename User_Name as Account_Name | ...| stats count by Account_Name'.</P> Mon, 28 Sep 2020 16:21:43 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Failed-Login-Top-Ten-count/m-p/127597#M26229 somesoni2 2020-09-28T16:21:43Z https://community.splunk.com/t5/Getting-Data-In/Windows-Failed-Login-Top-Ten-count/m-p/127598#M26230 <P>thank you for your reply, unfortunately putting |eval after rex did not work and using the rename function did not produce any results: </P> <P>source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex "(?ms)Account For Which Logon Failed.+?Account Name:s+(?<SECOND_ACCOUNTNAME>V+)" |rename User_Name as Account_Name |stats count by USER |sort -count |head 10</SECOND_ACCOUNTNAME></P> Mon, 28 Sep 2020 16:21:46 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Failed-Login-Top-Ten-count/m-p/127598#M26230 aberdamy 2020-09-28T16:21:46Z https://community.splunk.com/t5/Getting-Data-In/Windows-Failed-Login-Top-Ten-count/m-p/127599#M26231 <P>Sorry I miss-typed that last one, the correct search string is below. I get results however it is missing the "4625" events. Conversely, if I rename as User_Name it does not include the "529" events</P> <P>source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex "(?ms)Account For Which Logon Failed.+?Account Name:s+(?<SECOND_ACCOUNTNAME>V+)" |rename User_Name as Account_Name |stats count by Account_Name |sort -count |head 10</SECOND_ACCOUNTNAME></P> Mon, 28 Sep 2020 16:21:49 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Failed-Login-Top-Ten-count/m-p/127599#M26231 aberdamy 2020-09-28T16:21:49Z https://community.splunk.com/t5/Getting-Data-In/Windows-Failed-Login-Top-Ten-count/m-p/127600#M26232 <P>Solution:</P> <P>source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex field=_raw max_match=99 "Account Name:\s+(?<ACCOUNT_NAME>\w+\$?)" | eval UserName=coalesce(User_Name,Account_Name) | stats count by UserName |sort -count |head 10</ACCOUNT_NAME></P> Mon, 28 Sep 2020 16:22:11 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Failed-Login-Top-Ten-count/m-p/127600#M26232 aberdamy 2020-09-28T16:22:11Z https://community.splunk.com/t5/Getting-Data-In/Windows-Failed-Login-Top-Ten-count/m-p/127601#M26233 <P>So max=99 in rex command did it?</P> Fri, 11 Apr 2014 14:19:04 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Failed-Login-Top-Ten-count/m-p/127601#M26233 somesoni2 2014-04-11T14:19:04Z https://community.splunk.com/t5/Getting-Data-In/Windows-Failed-Login-Top-Ten-count/m-p/127602#M26234 <P>yes, appears to have worked. Of course, as you can see the rex has been changed as well</P> Fri, 11 Apr 2014 14:51:31 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Failed-Login-Top-Ten-count/m-p/127602#M26234 aberdamy 2014-04-11T14:51:31Z