topic Re: Failed Login Query in Splunk Search

Failed Login Query

Mmilaham — Fri, 17 Dec 2021 21:24:09 GMT

Hello,

I am trying to write a query that will display failed logins (Account_Name, Host, Count).

First Query

index=wineventlog EventCode=4625 | top limit=20 Account_Name host | where count > 9

Con

1. Displays "-" in some of the Account_Name fields

Pro

1. Displays all the count and host fields correctly.

Second Query

index=wineventlog EventCode=4625 | rex "(?ms)Account For Which Logon Failed.+?Account Name:\s+(?<Account_Name>\V+)" |top limit=30 Account_Name host| where count >=9

Con

Displays all the Account_Name, count and host fields correctly but displays a lot less results on the table compared to the first query.

Pro

Displays all the Account_Name, count and host fields correctly

I need a query that will displays all the Account_Name, count and host fields correctly as well as displays the same amount of results in the first query. Any help is appreciated. Thanks in advance.

Re: Failed Login Query

richgalloway — Fri, 17 Dec 2021 22:11:57 GMT

Once you start filtering out undesired account names the number of results will change. Perhaps this is more like what you're looking for.

index=wineventlog EventCode=4625 Account_Name!="-" ```Filter out -``` ```Count names``` | stats count by Account_Name host ```Filter out accounts with fewer than 10 failures``` | where count > 9 ```Sort in descending order by count and take the top 20 results``` | sort 20 - count

Re: Failed Login Query

Mmilaham — Fri, 17 Dec 2021 22:48:10 GMT

I'm still getting fewer result compared to running the first query. Also some of the Account Name are wrong(It's just displaying the Host name).

Re: Failed Login Query

richgalloway — Sat, 18 Dec 2021 02:47:22 GMT

Like I said, it's not possible to discard some results and still end up with the same number of results.

The stats command should not be returning results with just the host name in them. Please share your output (sanitized as necessary).