https://community.splunk.com/t5/Splunk-Search/How-to-find-RSA-connection-failures-for-a-user/m-p/309007#M92671 <P>Most RSA connection failures have the words "connection failure" in them, although the capitalization and the surrounding words change based on the type of failure. Start with...</P> <PRE><CODE>index=myindex sourcetype=mysourcetype "connection" "failed" "someuserid" | head 1 </CODE></PRE> <P>...and then use the specific wording of the record you find to craft a more careful way of extracting them. Check whether the userid appears in a specific extracted field or not, and so on. Once you have that information, then you can make a better query than that one. </P> <P>If you don't know the sourcetype or index they are in, then use * and keep narrowing it down until you figure it out.</P> Tue, 23 May 2017 20:01:54 GMT DalJeanis 2017-05-23T20:01:54Z https://community.splunk.com/t5/Splunk-Search/How-to-find-RSA-connection-failures-for-a-user/m-p/309006#M92670 <P>I need a script that will find rsa connection failures for a user</P> Tue, 23 May 2017 17:39:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-RSA-connection-failures-for-a-user/m-p/309006#M92670 aarnelson 2017-05-23T17:39:05Z https://community.splunk.com/t5/Splunk-Search/How-to-find-RSA-connection-failures-for-a-user/m-p/309007#M92671 <P>Most RSA connection failures have the words "connection failure" in them, although the capitalization and the surrounding words change based on the type of failure. Start with...</P> <PRE><CODE>index=myindex sourcetype=mysourcetype "connection" "failed" "someuserid" | head 1 </CODE></PRE> <P>...and then use the specific wording of the record you find to craft a more careful way of extracting them. Check whether the userid appears in a specific extracted field or not, and so on. Once you have that information, then you can make a better query than that one. </P> <P>If you don't know the sourcetype or index they are in, then use * and keep narrowing it down until you figure it out.</P> Tue, 23 May 2017 20:01:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-RSA-connection-failures-for-a-user/m-p/309007#M92671 DalJeanis 2017-05-23T20:01:54Z