Dashboards & Visualizations

Dashboards - Show line charts by users, how many failed log in and time

test_qweqwe
Builder

I wanna this:
http://prntscr.com/h9xqgm

This is my search:
eventtype=msad-failed-user-logons (host="*")|fields _time,signature,src_ip,src_host,src_nt_host,src_nt_domain,user,Logon_Type |ip-to-host|fix-localhost|stats count by user,src_nt_host,src_ip|sort -count|rename user as "Username" src_nt_host as "Workstation",src_ip as "IP Address" | head 6

Results of search:
http://prntscr.com/h9xjt8

I need include to line charts - users, have my times failed log in and time. How should I change this search?

0 Karma
1 Solution

niketn
Legend

@test_qweqwe, you want to plot a timechart then you need _time as one of the fields. Your stats query is removing _time field. Also if you just need count by user over _time, you do not need to worry about other fields. Try the following search. I am expecting your eventtype msad-failed-user-logons gives only failed user logon events.

eventtype=msad-failed-user-logons (host="*")
| timechart count by user
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@test_qweqwe, you want to plot a timechart then you need _time as one of the fields. Your stats query is removing _time field. Also if you just need count by user over _time, you do not need to worry about other fields. Try the following search. I am expecting your eventtype msad-failed-user-logons gives only failed user logon events.

eventtype=msad-failed-user-logons (host="*")
| timechart count by user
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...