Dashboard for login failure followed by lockout

himapate — Sat, 18 Feb 2017 05:26:00 GMT

HI ,

I have query for login failure followed with lockout i can search the data and run in the search and reporting app but i am unable to save it as a dashboard . The dashboard shows waiting for inputs . Below is the search string .

earliest=-1d@d latest=@d index=wineventlog sourcetype=WinEventLog:Security EventCode="4740" 
 | eval Account=mvindex(Account_Name, 1)
 | stats count, latest(_time) AS lastBlock by Account
 | eval modtime=lastBlock - 7200
 | fields - count
 | map maxsearches=1000 search="search index=wineventlog sourcetype=WinEventLog:Security (EventCode="4625" OR EventCode="4768" OR EventCode="4771" OR EventCode="4776") earliest=$modtime$ latest=$lastBlock$ Account_Name=$Account$"
 | eval Account=case(EventCode="4740" OR EventCode="4625", mvindex(Account_Name, 1), EventCode="4768" OR EventCode="4771", Account_Name, EventCode="4776", Logon_Account, 1=1, "Click-on-me")
 | regex Account!="\\$"
 | eval errorMessages=case(EventCode="4768", (EventCode."; ".Result_Code), EventCode="4771", (EventCode."; ".Failure_Code), EventCode="4776", (EventCode."; ".Error_Code), 1=1, "Click-on-me")
 | stats count, latest(_time) AS lastFailure, values(Failure_Reason) AS failureReason, values(errorMessages) AS otherFailures by Account src_ip 
 | convert ctime(lastFailure) 
 | rename Account AS "Blocked Account", count AS LoginFailures

The error is due to the token being passed which doest not work in dashboard can someone help.

Re: Dashboard for login failure followed by lockout

skoelpin — Sat, 18 Feb 2017 20:58:37 GMT

You gotta change the dashboard to a form if your using anytype of input

Re: Dashboard for login failure followed by lockout

woodcock — Sat, 18 Feb 2017 22:33:02 GMT

You are correct about the cause. To fix, edit the source XML and change all of your dollar-signs ('$') to double-dollar-signs ('$$'), like this: $$modtime$$.

Re: Dashboard for login failure followed by lockout

himapate — Sun, 19 Feb 2017 08:44:54 GMT

It worked thanks

topic Re: Dashboard for login failure followed by lockout in Dashboards & Visualizations

Dashboard for login failure followed by lockout

Re: Dashboard for login failure followed by lockout

Re: Dashboard for login failure followed by lockout

Re: Dashboard for login failure followed by lockout