topic Re: Windows security events search in Splunk Search

Windows security events search

lohit — Wed, 14 Aug 2013 07:56:21 GMT

I have to capture the failed login attempts over windows machines.
I am filtering on the basis of EventCode=4625.
For a particular User,I am getting multiple events for a time event, like failed events for a user are coming around 10-11 in 1 minute.
Please help me with this search so that I can remove all the redundancy of user names like "-".
I want to display 4 fields- user name, last login, host, total count of failed events

Re: Windows security events search

MarioM — Wed, 14 Aug 2013 08:18:09 GMT

Why not using the windows app and AD app?

Splunk for Windows

Splunk for Active Directory

They have those kind of searches/reports and you can add yours too.

Re: Windows security events search

lohit — Wed, 14 Aug 2013 08:32:54 GMT

i am asked to make a self search for this.

Re: Windows security events search

lukejadamec — Mon, 28 Sep 2020 14:34:05 GMT

What you are seeing is the effect of having two fields named Account Name. The count for - will equal the sum of all other Account Names.

Use this to check the first entry for a value, and if its null then get the second entries value:

eval User = if(isnull(Account_Name), User_Name, mvindex(Account_Name,1))

This will create the new value User, but you will probably have to 'View all fields' to see it.
The User field will not contain -.

You can find more information here:
http://answers.splunk.com/answers/2649/same-fields-with-different-values-in-one-event

Re: Windows security events search

splunk68 — Wed, 14 Aug 2013 12:44:34 GMT

You could try something like this:

index="MyIndex" EventCode="4625" | eval Username=(mvindex(Account_Name,1)) | stats count by Username,host | table Username,host,count

Regarding "last login",you could simply do a search like:

index="MyIndex" EventCode="4625" | eval Username=(mvindex(Account_Name,1)) | dedup Username | table _time,Username,host

I guess combining "last login" with the count of failed events is a little bit tricky. You could try appending a search.