Alerting

Manipulating Timewrap output: How can I create an alert when a user has a consistently high number of failed logins over a given time period?

SplunkCOB
New Member

I want to alert when a user has a consistently high number of failed logins over a given time period - e.g. if over 3 days a user had 5 failed logins on each day the alert would trigger, but if one day had 30 failed logins and day 2 and 3 had no or very few failed logins the alert would not trigger.

I started with the following:

| timechart span=1d count by User useother=f usenull=f | timewrap 1d series=short

This would give me an output of:

 User1_s0 | User1_s1 | User1_s2 | User1_s3 
 3         4            5        6

My current logic is:

| timechart span=1d count by User useother=f usenull=f | timewrap 1d series=short | where s0 > 10 AND s1 > 10 AND s2>10

However, that doesn't give me any results and the docs for timewrap don't show many examples of how to reference each day as it were/perform further operations on the results.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...