Archive
Highlighted

Splunk counting duplicate events for failed logon

Path Finder

When the below search is ran, it'll count duplicate failed logons for all users. How do I exclude duplicates in a count?

eventtype=msad-failed-user-logons
(host="*")|fields
time,signature,srcip,srchost,srcnthost,srcntdomain,user,LogonType|stats
count by
user,srcntdomain,srcip,|sort
-count|rename user as "Username", src
ntdomain as "Domain", srcip as
"IP Address"

0 Karma
Highlighted

Re: Splunk counting duplicate events for failed logon

SplunkTrust
SplunkTrust

Try this -

eventtype=msad-failed-user-logons (host="*")
| fields_time, signature, src_ip, src_host, src_nt_host, src_nt_domain, user, Logon_Type
| dedup signature
| stats count by user, src_nt_domain, src_ip,
| sort - count
| rename user as "Username", src_nt_domain as "Domain", src_ip as "IP Address"

Based on the assumption that the dups will have the same signature.

View solution in original post

0 Karma
Highlighted

Re: Splunk counting duplicate events for failed logon

Path Finder

I dedup _time instead and it seemed to work better. Thanks

Highlighted

Re: Splunk counting duplicate events for failed logon

SplunkTrust
SplunkTrust

@bayman - thanks for letting us know what worked. Interesting that the signature might be different between two duplicate events. Must mean something different from what I was guessing.

0 Karma
Highlighted

Re: Splunk counting duplicate events for failed logon

Splunk Employee
Splunk Employee

Hey @bayman, if @DalJeanis's solution worked then please don't forget to accept their answer to award karma points and close the question. 🙂