When the below search is ran, it'll count duplicate failed logons for all users. How do I exclude duplicates in a count?
-count|rename user as "Username", srcntdomain as "Domain", srcip as
Try this -
eventtype=msad-failed-user-logons (host="*") | fields_time, signature, src_ip, src_host, src_nt_host, src_nt_domain, user, Logon_Type | dedup signature | stats count by user, src_nt_domain, src_ip, | sort - count | rename user as "Username", src_nt_domain as "Domain", src_ip as "IP Address"
Based on the assumption that the dups will have the same signature.
@bayman - thanks for letting us know what worked. Interesting that the signature might be different between two duplicate events. Must mean something different from what I was guessing.
Hey @bayman, if @DalJeanis's solution worked then please don't forget to accept their answer to award karma points and close the question. 🙂