Splunk Search

Trending of Login Failures to establish a baseline of processing normalcy.

splunkit2010
Explorer

Hello. What is the best way to trend login failures. Would like to create a baseline of processing normalcy over a two week period. Also, how would we retain this information for future comparisons? Thanks.

Tags (1)
0 Karma

richcollier
Path Finder

The Prelert Anomaly Detective app uses machine-learning algorithms to automatically learn the baseline rates of your events and uses that information to detect anomalies in current data. It can auto-learn the base line in 3 modes:

  • over a wide search period that you define
  • comparing two discrete time periods against each other
  • ongoing in real-time

Sounds like it would be useful for your use-case!

0 Karma

efavreau
Motivator

Page produces a 404. Is there nothing in core splunk?

###

If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...