https://community.splunk.com/t5/Splunk-Search/looking-for-unknown-but-equal-field-values-across-single-search/m-p/58935#M14495 <P>I'm doing a search for invalid logons for our vpn logs. But I want the search results to return when the invalid attempts reach 5 or more from the same user but I don't know the user ahead of time. If a user has 5 or more invalid logon attempts, I want it to alert. Right now I can get all the invalid attempts from all users in the time frame I'm looking at but I don't know how to narrow that down to just alerting on if one user has 5 or more attempts. Please help. Thanks.</P> Tue, 28 Sep 2010 04:18:19 GMT aanetserv 2010-09-28T04:18:19Z https://community.splunk.com/t5/Splunk-Search/looking-for-unknown-but-equal-field-values-across-single-search/m-p/58935#M14495 <P>I'm doing a search for invalid logons for our vpn logs. But I want the search results to return when the invalid attempts reach 5 or more from the same user but I don't know the user ahead of time. If a user has 5 or more invalid logon attempts, I want it to alert. Right now I can get all the invalid attempts from all users in the time frame I'm looking at but I don't know how to narrow that down to just alerting on if one user has 5 or more attempts. Please help. Thanks.</P> Tue, 28 Sep 2010 04:18:19 GMT https://community.splunk.com/t5/Splunk-Search/looking-for-unknown-but-equal-field-values-across-single-search/m-p/58935#M14495 aanetserv 2010-09-28T04:18:19Z https://community.splunk.com/t5/Splunk-Search/looking-for-unknown-but-equal-field-values-across-single-search/m-p/58936#M14496 <P>Have you tried attaching the following to your search (you will need to replace user with the field that represents your failed user) </P> <P>"your search here" | stats count by user | search count &gt; 4</P> <P>This should filter the failed users to only show ones that have failed 5 times or more. </P> <P>travis.</P> Tue, 28 Sep 2010 21:45:29 GMT https://community.splunk.com/t5/Splunk-Search/looking-for-unknown-but-equal-field-values-across-single-search/m-p/58936#M14496 thall79 2010-09-28T21:45:29Z https://community.splunk.com/t5/Splunk-Search/looking-for-unknown-but-equal-field-values-across-single-search/m-p/58937#M14497 <P>Thanks, that's what I was looking for, it worked.</P> Sat, 02 Oct 2010 01:25:00 GMT https://community.splunk.com/t5/Splunk-Search/looking-for-unknown-but-equal-field-values-across-single-search/m-p/58937#M14497 aanetserv 2010-10-02T01:25:00Z