https://community.splunk.com/t5/Splunk-Search/Password-spraying-search/m-p/564334#M196591 <P>I made those changes still i am not getting the result what am expecting.</P> Mon, 23 Aug 2021 13:33:16 GMT kuriakose 2021-08-23T13:33:16Z https://community.splunk.com/t5/Splunk-Search/Password-spraying-search/m-p/564322#M196586 <P>Hi,</P><P>&nbsp;</P><P>I am attempting to create a search for a password spraying attempt. I need the IP address and Hostname made with the different login names attempted to login to a particular machine within the last 5 min. Also, the number of login attempts should be more than 10.</P><P>&nbsp;</P><P>I created the below search, but that's pulling me wrong data. A sample data am expecting is attached in the screenshot</P><P>index=win* EventCode=4625 Logon_Type=3 Target_User_Name!="" src_ip!="-" |bucket span=5m _time<BR />|stats dc(TargetUserName) AS Unique_accounts values(TargetUserName) as tried_accounts by _time, src_ip Source_Workstation |eventstats avg(Unique_accounts) as global_avg, stdev(Unique_accounts) as global_std |eval upperBound=(comp_avg+comp_std*3) |eval isOutlier=if(Unique_accounts&gt;10 and Unique_accounts&gt;=upperBound, 1, 0) |sort -Unique_accounts</P><P>&nbsp;</P><P>Thanks in advance.</P> Mon, 23 Aug 2021 12:53:09 GMT https://community.splunk.com/t5/Splunk-Search/Password-spraying-search/m-p/564322#M196586 kuriakose 2021-08-23T12:53:09Z https://community.splunk.com/t5/Splunk-Search/Password-spraying-search/m-p/564330#M196590 <P>comp_avg and comp_std don't exist, you named them global_avg and global_std in the eventstats command</P> Mon, 23 Aug 2021 13:11:08 GMT https://community.splunk.com/t5/Splunk-Search/Password-spraying-search/m-p/564330#M196590 ITWhisperer 2021-08-23T13:11:08Z https://community.splunk.com/t5/Splunk-Search/Password-spraying-search/m-p/564334#M196591 <P>I made those changes still i am not getting the result what am expecting.</P> Mon, 23 Aug 2021 13:33:16 GMT https://community.splunk.com/t5/Splunk-Search/Password-spraying-search/m-p/564334#M196591 kuriakose 2021-08-23T13:33:16Z https://community.splunk.com/t5/Splunk-Search/Password-spraying-search/m-p/564341#M196594 <P>In what way does it differ from what you expected?</P> Mon, 23 Aug 2021 13:51:30 GMT https://community.splunk.com/t5/Splunk-Search/Password-spraying-search/m-p/564341#M196594 ITWhisperer 2021-08-23T13:51:30Z