https://community.splunk.com/t5/Alerting/Splunk-Alert-based-on-threshold-of-failed-logins-within-a/m-p/302651#M5450 <P>Have you tried eventstats? Like so:</P> <PRE><CODE>sourcetype=* result=FAILURE | bucket _time span=1m | eventstats count by username, src | search count &gt; 4 | table username device result reason src _time count </CODE></PRE> Mon, 10 Jul 2017 23:03:22 GMT sk314 2017-07-10T23:03:22Z https://community.splunk.com/t5/Alerting/Splunk-Alert-based-on-threshold-of-failed-logins-within-a/m-p/302650#M5449 <P>Splunk Gurus, </P> <P>I am looking to build search that will identify any accounts that experience 5 failed login attempts within a 1 minute time span. The intent is to run a daily report highlight accounts with large amount of failures within a short period of time (potentially a bruteforce effort) for troubleshooting/customer service. </P> <PRE><CODE>sourcetype=* result=FAILURE | table username, device, result, reason, src, "_time" | bucket _time span=1m | stats count by username, src | search count &gt; 4 </CODE></PRE> Mon, 10 Jul 2017 22:26:01 GMT https://community.splunk.com/t5/Alerting/Splunk-Alert-based-on-threshold-of-failed-logins-within-a/m-p/302650#M5449 cdabbey 2017-07-10T22:26:01Z https://community.splunk.com/t5/Alerting/Splunk-Alert-based-on-threshold-of-failed-logins-within-a/m-p/302651#M5450 <P>Have you tried eventstats? Like so:</P> <PRE><CODE>sourcetype=* result=FAILURE | bucket _time span=1m | eventstats count by username, src | search count &gt; 4 | table username device result reason src _time count </CODE></PRE> Mon, 10 Jul 2017 23:03:22 GMT https://community.splunk.com/t5/Alerting/Splunk-Alert-based-on-threshold-of-failed-logins-within-a/m-p/302651#M5450 sk314 2017-07-10T23:03:22Z https://community.splunk.com/t5/Alerting/Splunk-Alert-based-on-threshold-of-failed-logins-within-a/m-p/302652#M5451 <P>I can definitely build on this, and really appreciate the help!</P> Wed, 12 Jul 2017 21:51:29 GMT https://community.splunk.com/t5/Alerting/Splunk-Alert-based-on-threshold-of-failed-logins-within-a/m-p/302652#M5451 cdabbey 2017-07-12T21:51:29Z