https://community.splunk.com/t5/Splunk-Search/Multiple-failed-logins-to-corporate-wifi/m-p/380131#M168956 <P>I wanted to go over the following use case idea I had that I’ve been working. Basically, I am looking to gather abnormal failed authentications, for example thousands of failed attempts in a 5 minute period on any given day when normally we see many dozens. i am not getting expected results. Thanks.</P> <P>| tstats count values(Authentication.action) as Action, values(Authentication.user) as User, values(Authentication.src) as Source, values(Authentication.dest) as "dest" from datamodel="Authentication" where (index=acs Authentication.action!=success by Authentication.user | appendcols [| tstats count from datamodel=Authentication where Authentication.action=failure earliest=-30d latest=now by Authentication.user, _time span=5m | stats mean(count) as mean stdev(count) as stdev] | where count&gt;mean+stdev</P> Mon, 11 Jun 2018 17:15:35 GMT Ghanayem1974 2018-06-11T17:15:35Z https://community.splunk.com/t5/Splunk-Search/Multiple-failed-logins-to-corporate-wifi/m-p/380131#M168956 <P>I wanted to go over the following use case idea I had that I’ve been working. Basically, I am looking to gather abnormal failed authentications, for example thousands of failed attempts in a 5 minute period on any given day when normally we see many dozens. i am not getting expected results. Thanks.</P> <P>| tstats count values(Authentication.action) as Action, values(Authentication.user) as User, values(Authentication.src) as Source, values(Authentication.dest) as "dest" from datamodel="Authentication" where (index=acs Authentication.action!=success by Authentication.user | appendcols [| tstats count from datamodel=Authentication where Authentication.action=failure earliest=-30d latest=now by Authentication.user, _time span=5m | stats mean(count) as mean stdev(count) as stdev] | where count&gt;mean+stdev</P> Mon, 11 Jun 2018 17:15:35 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-failed-logins-to-corporate-wifi/m-p/380131#M168956 Ghanayem1974 2018-06-11T17:15:35Z