How to create an alert for password sharing across multiple countries for all logins across different hosts and applications with more than 60 indexes?

[vellas78]

I tried using this query:

index=* tag=authentication action=success OR action=failure

Initially to retrieve user logins from all the applications and devices but I think it will take more time and also the load and search time on the index will create performance issues. Kindly suggest some solution.

[FrankVl · Accepted solution]

Sounds like a typical case to use an accelerated data model. In this case accelerating the CIM Authentication Data Model over the relevant set of indexes could be a solution worth trying.
http://docs.splunk.com/Documentation/CIM/4.10.0/User/Setup#Accelerating_CIM_data_models

That way, authentication events from all these indexes are checked periodically (depending on your acceleration settings) and the key fields are stored in data model summaries.

This would allow you to do an efficient tstats based query over the data in your accelerated data model, to for instance count the number of logins by _time, user, src and action and then apply further logic to that, to determine accounts being shared between systems that are in different locations.