Splunk Enterprise

Splunk counting duplicate events for failed logon

bayman
Path Finder

When the below search is ran, it'll count duplicate failed logons for all users. How do I exclude duplicates in a count?

eventtype=msad-failed-user-logons
(host="*")|fields
_time,signature,src_ip,src_host,src_nt_host,src_nt_domain,user,Logon_Type|stats
count by
user,src_nt_domain,src_ip,|sort
-count|rename user as "Username", src_nt_domain as "Domain", src_ip as
"IP Address"

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Try this -

eventtype=msad-failed-user-logons (host="*")
| fields_time, signature, src_ip, src_host, src_nt_host, src_nt_domain, user, Logon_Type
| dedup signature
| stats count by user, src_nt_domain, src_ip,
| sort - count
| rename user as "Username", src_nt_domain as "Domain", src_ip as "IP Address"

Based on the assumption that the dups will have the same signature.

View solution in original post

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @bayman, if @DalJeanis's solution worked then please don't forget to accept their answer to award karma points and close the question. 🙂

DalJeanis
SplunkTrust
SplunkTrust

Try this -

eventtype=msad-failed-user-logons (host="*")
| fields_time, signature, src_ip, src_host, src_nt_host, src_nt_domain, user, Logon_Type
| dedup signature
| stats count by user, src_nt_domain, src_ip,
| sort - count
| rename user as "Username", src_nt_domain as "Domain", src_ip as "IP Address"

Based on the assumption that the dups will have the same signature.

0 Karma

bayman
Path Finder

I dedup _time instead and it seemed to work better. Thanks

DalJeanis
SplunkTrust
SplunkTrust

@bayman - thanks for letting us know what worked. Interesting that the signature might be different between two duplicate events. Must mean something different from what I was guessing.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...