topic Re: stats count eval match issue in Splunk Search

stats count eval match issue

jwalzerpitt — Wed, 22 Jul 2020 15:27:59 GMT

I have a generic search that is looking for logins and there is a field that has two values – “authentication” for a successful login, and “failed login” for a failed login.

So I modified an existing search that looks for X amount >=3 attempts with success >0 and failed >=3 within 15 mins like so:

index="foo" host="bar" Application="app1" | dedup _time | eval time = _time | bin time span=15m | stats count("Activity Name") as Attempts, count(eval(match("Activity Name","FAILED LOGIN"))) as Failed, count(eval(match("Activity Name","AUTHENTICATION"))) as Success earliest(_time) as FirstAttempt latest(_time) as LatestAttempt by Username time | rename time as _time | search Attempts>=3 AND Success>0 AND Failed>=3 | eval FirstAttempt=strftime(FirstAttempt,"%x %X") | eval LatestAttempt=strftime(LatestAttempt,"%x %X")

For some reason it is not liking the count(eval(match as if I shorten the search to the following, I see results for attempts, but nothing for success or failed

Any help would be greatly appreciated

Thx

Re: stats count eval match issue

spitchika — Wed, 22 Jul 2020 15:52:01 GMT

Hi,

I am not able to try this as I am not having logs.

But did we miss "if" in it??

Can you try like below?

count(eval(if((match("Activity Name" == "FAILED LOGIN"

Re: stats count eval match issue

jwalzerpitt — Wed, 22 Jul 2020 17:24:40 GMT

@spitchika - thx for the reply. With the help of a fellow Splunker the issue was I need single quotes and not double quotes for field name in the eval commands as such:

index="foo" host="bar" Application="app1" | dedup _time | eval time = _time | bin time span=15m | stats count("Activity Name") as Attempts, count(eval(match('Activity Name',"FAILED LOGIN"))) as Failed, count(eval(match('Activity Name',"AUTHENTICATION"))) as Success earliest(_time) as FirstAttempt latest(_time) as LatestAttempt by Username time

Re: stats count eval match issue

spitchika — Wed, 22 Jul 2020 18:54:19 GMT

@jwalzerpitt Thank you for mentioning correct answer