range() function

[m_nouman]

I want to search for an Account_Name that has the maximum number of login attempts within a span of 10 minutes with range() function.....

I don't know how can i provide the parameters to this function....

some help will be appreciated!

[VatsalJagani]

@m_nouman - You need to use time_window for streamstats command, as suggested by @PickleRick 

For timechart and bin command use span=10m

I hope this helps!!!

[PickleRick]

And how did you come up with the range() stats function? This function is for something completely different - it tells you what's the difference between lowest and highest value in your result set whereas you want to count things. The range() function is completely unsuited for this.

You should be doing count by Account_Name. In order to make it over sliding window, you need to use streamstats with a proper time window.

<your_initial_search>
| streamstats time_window=10m count by Account_Name

This will give you counts of logins over 10 minute windows. From this you'll be able to pick the one with the highest count. For example with

| sort - count | head 

[OzRL5]

from hackthebox academy it's one of their questions and the hint is to use the range() function