topic How to seperate succefully login attempt from invlaid Login id in Splunk Search

How to seperate succefully login attempt from invlaid Login id

jaibalaraman — Tue, 02 Apr 2024 22:43:17 GMT

Hi Team

Can anyone help me with Splunk search query to split the successful login from invalid?

Ex - I want to exclude OK from the search, want to see only the locket out, invalid, invalid parameter

Thanks

Re: How to seperate succefully login attempt from invlaid Login id

ITWhisperer — Tue, 02 Apr 2024 22:51:12 GMT

| where event.Properties.errMessage != "OK"

Re: How to seperate succefully login attempt from invlaid Login id

bowesmana — Tue, 02 Apr 2024 22:56:31 GMT

Or based on your other question, you can directly set that criteria in the initial search, i.e.

index=test event.Properties.errMessage!=OK

Re: How to seperate succefully login attempt from invlaid Login id

jaibalaraman — Tue, 02 Apr 2024 23:31:12 GMT

I tried,, but the search returning no result.

Re: How to seperate succefully login attempt from invlaid Login id

bowesmana — Wed, 03 Apr 2024 00:25:08 GMT

Whenever you use a field name in an 'eval' expression (where requires an eval expression), you need to use single quotes around the field name if the field name is on the right hand side of the eval statement and contains non-simple characters (in this case the full stop), so

| where 'event.Properties.errMessage' != "OK"

Note the sometimes confusing use of single and double quotes used, for example this statement

| eval event.Properties.errMessage="Hello"

does NOT need quotes on the left hand side of the statement.

Where necessary, the left hand side use of quotes requires double quotes, so if your field name has a space, you would need

| eval "My Field With Spaces"="Hello"

Re: How to seperate succefully login attempt from invlaid Login id

jaibalaraman — Thu, 04 Apr 2024 03:09:16 GMT

How do i seperate multiple error instead " OK "

Invalid password, reset password, permission denied etc

index=events event.Properties.errMessage != "Invalid LoginID","Account Temporarily Locked Out","Permission denied""Unauthorized user","Account Pending Verification","Invalid parameter value"
| stats count by event.Properties.errMessage

Re: How to seperate succefully login attempt from invlaid Login id

ITWhisperer — Thu, 04 Apr 2024 08:55:02 GMT

Try something like this

index=events event.Properties.errMessage!="Invalid LoginID" event.Properties.errMessage!="Account Temporarily Locked Out" event.Properties.errMessage!="Permission denied" event.Properties.errMessage!="Unauthorized user" event.Properties.errMessage!="Account Pending Verification" event.Properties.errMessage!="Invalid parameter value" | stats count by event.Properties.errMessage