All Apps and Add-ons

How to edit my search to create a table to show User, Failed Authentication Attempts, Domain, and Lockout status?

HCadmins
Communicator

Hi Splunkers:

I am trying to create a simple table that has the columns: User, Failed Authentication Attempts, Domain, and Locked?

User would be, of course the user
Failed Authentication Attempts would show up if greater than 3
Domain would show the domain they were attempting to authenticate against
Locked would be a yes or no value

It's the locked out part I am having trouble with.

Here is my search:

index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740")  | head 10 | stats count by user Account_Domain | search count>3 | table user count Account_Domain | rename user as "User" count as "Failed Authentication Attempts" Account_Domain as "Domain"
0 Karma
1 Solution

sundareshr
Legend

See if this helps

index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740") | head 10 | stats count count(eval(EventCode=4740)) as LockedCount by user Account_Domain | search count>3 | eval Locked=if(LockedCount>1, "yes", "no")  | table user count Account_Domain Locked | rename user as "User" count as "Failed Authentication Attempts" Account_Domain as "Domain"

View solution in original post

0 Karma

sundareshr
Legend

See if this helps

index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740") | head 10 | stats count count(eval(EventCode=4740)) as LockedCount by user Account_Domain | search count>3 | eval Locked=if(LockedCount>1, "yes", "no")  | table user count Account_Domain Locked | rename user as "User" count as "Failed Authentication Attempts" Account_Domain as "Domain"
0 Karma

HCadmins
Communicator

Error in 'eval' command: The arguments to the 'if' function are invalid.

0 Karma

sundareshr
Legend

Fixed typo

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...