Dashboards & Visualizations

Dashboards - Show line charts by users, how many failed log in and time

test_qweqwe
Builder

I wanna this:
http://prntscr.com/h9xqgm

This is my search:
eventtype=msad-failed-user-logons (host="*")|fields _time,signature,src_ip,src_host,src_nt_host,src_nt_domain,user,Logon_Type |ip-to-host|fix-localhost|stats count by user,src_nt_host,src_ip|sort -count|rename user as "Username" src_nt_host as "Workstation",src_ip as "IP Address" | head 6

Results of search:
http://prntscr.com/h9xjt8

I need include to line charts - users, have my times failed log in and time. How should I change this search?

0 Karma
1 Solution

niketnilay
Legend

@test_qweqwe, you want to plot a timechart then you need _time as one of the fields. Your stats query is removing _time field. Also if you just need count by user over _time, you do not need to worry about other fields. Try the following search. I am expecting your eventtype msad-failed-user-logons gives only failed user logon events.

eventtype=msad-failed-user-logons (host="*")
| timechart count by user
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketnilay
Legend

@test_qweqwe, you want to plot a timechart then you need _time as one of the fields. Your stats query is removing _time field. Also if you just need count by user over _time, you do not need to worry about other fields. Try the following search. I am expecting your eventtype msad-failed-user-logons gives only failed user logon events.

eventtype=msad-failed-user-logons (host="*")
| timechart count by user
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!