Correct way to do count over time

[Vantine]

Trying to set up an alert to show any log in that has had 500 log on failures in under 30 min.

Here is what I currently have (with non relevant data changed)

index=* sourcetype=* action=failure EventCode=4771 OR EventCode=4776 | bucket _time span=30m | stats count by user | where count>500

I want to make sure this is correct.

Thanks!

[gcusello]

Hi @Vantine,

yes it's correct.

You're speaking of windows log so you could simplify (and make faster) your search in this way:

index=wineventlog sourcetype=wineventlog EventCode=4771 OR EventCode=4776 
| timechart span=30m count by user 
| where count>500

Ciao.

Giuseppe

[Vantine]

Wasnt getting results, so I went longer and smaller errors. Still not getting anything.

Here is how I have it

index=eits_wineventlog_security sourcetype=WinEventLog  EventCode=4771 OR EventCode=4776

| timechart span=60m count by user
| where count>5

I know for sure we have had enough failures to at least get a few.

Thanks

[gcusello · Accepted solution]

Hi @Vantine,

don't use timechart:

index=eits_wineventlog_security sourcetype=WinEventLog (EventCode=4771 OR EventCode=4776)
| bin span=60m _time
| stats count BY user _time
| where count>5

Ciao.

Giuseppe