https://community.splunk.com/t5/Splunk-Search/How-to-display-the-number-of-failures-plus-earliest-time-and/m-p/628194#M218221 <P>Given web access log data with following fields:</P> <P>_time,&nbsp; http_status, src_ip, dest_ip</P> <P>After a bruteforce attack on a login page, where http_status of 200=success and 401=failure,&nbsp;how can I display the number of failures, plus earliest(_time) and latest(_time) by src_ip</P> <P>I've tried using streamstats like below, but do not get what I'm looking for</P> <P>index=myIndex AND status=*<BR />| table _time status src_ip dest_ip<BR />| sort + _time<BR />| streamstats reset_on_change=true count earliest(_time) AS ET latest(_time) AS LT by status<BR />| convert ctime(ET) ctime(LT)</P> Wed, 25 Jan 2023 15:58:25 GMT mikefoti 2023-01-25T15:58:25Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-number-of-failures-plus-earliest-time-and/m-p/628194#M218221 <P>Given web access log data with following fields:</P> <P>_time,&nbsp; http_status, src_ip, dest_ip</P> <P>After a bruteforce attack on a login page, where http_status of 200=success and 401=failure,&nbsp;how can I display the number of failures, plus earliest(_time) and latest(_time) by src_ip</P> <P>I've tried using streamstats like below, but do not get what I'm looking for</P> <P>index=myIndex AND status=*<BR />| table _time status src_ip dest_ip<BR />| sort + _time<BR />| streamstats reset_on_change=true count earliest(_time) AS ET latest(_time) AS LT by status<BR />| convert ctime(ET) ctime(LT)</P> Wed, 25 Jan 2023 15:58:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-number-of-failures-plus-earliest-time-and/m-p/628194#M218221 mikefoti 2023-01-25T15:58:25Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-number-of-failures-plus-earliest-time-and/m-p/628196#M218222 <LI-CODE lang="markup">index=myIndex AND status=* | table _time status src_ip dest_ip | sort + _time | stats count(eval(status="401")) as count earliest(_time) AS ET latest(_time) AS LT by src_ip</LI-CODE> Tue, 24 Jan 2023 19:23:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-number-of-failures-plus-earliest-time-and/m-p/628196#M218222 ITWhisperer 2023-01-24T19:23:00Z