https://community.splunk.com/t5/Splunk-Search/5-and-above-login-failures/m-p/43807#M10316 <P>I have managed to create a search that finds users that have failed to login within the last 24 hours but I want to only see users who fail to login 5 or more times.</P> <P>This is what I have so far:</P> <P>source="<EM>secure</EM>" sshd "pam_ldap: error trying to bind as user" | top uid</P> <P>How can I make it so it onlys shows 5 or more failed logins per user?</P> <P>Thanks, </P> Fri, 23 Nov 2012 13:16:43 GMT robK123 2012-11-23T13:16:43Z https://community.splunk.com/t5/Splunk-Search/5-and-above-login-failures/m-p/43807#M10316 <P>I have managed to create a search that finds users that have failed to login within the last 24 hours but I want to only see users who fail to login 5 or more times.</P> <P>This is what I have so far:</P> <P>source="<EM>secure</EM>" sshd "pam_ldap: error trying to bind as user" | top uid</P> <P>How can I make it so it onlys shows 5 or more failed logins per user?</P> <P>Thanks, </P> Fri, 23 Nov 2012 13:16:43 GMT https://community.splunk.com/t5/Splunk-Search/5-and-above-login-failures/m-p/43807#M10316 robK123 2012-11-23T13:16:43Z https://community.splunk.com/t5/Splunk-Search/5-and-above-login-failures/m-p/43808#M10317 <P>You could filter the results of top like so:</P> <PRE><CODE>... | top uid | where count &gt;= 5 </CODE></PRE> Fri, 23 Nov 2012 13:38:50 GMT https://community.splunk.com/t5/Splunk-Search/5-and-above-login-failures/m-p/43808#M10317 martin_mueller 2012-11-23T13:38:50Z https://community.splunk.com/t5/Splunk-Search/5-and-above-login-failures/m-p/43809#M10318 <P>That worked perfectly thanks.</P> Fri, 23 Nov 2012 13:54:00 GMT https://community.splunk.com/t5/Splunk-Search/5-and-above-login-failures/m-p/43809#M10318 robK123 2012-11-23T13:54:00Z