Here is my search
index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740") | stats count count(eval(EventCode=4740)) as LockedCount by user Account_Domain | search count>3 | eval Locked=if(LockedCount>1, "Yes", "No") | table _time user count Account_Domain Locked | rename user as "User" count as "Failed Authentication Attempts" Account_Domain as "Domain"
When I look at the log raw data, there is clearly a time stamp.
The stats
command is only passing the count, LockedCount, user, and Account_Domain fields to downstream commands so there is no _time to display. Try using either eventstats
or streamstats
.
The stats
command is only passing the count, LockedCount, user, and Account_Domain fields to downstream commands so there is no _time to display. Try using either eventstats
or streamstats
.
Okay, that made it work. Why is count in there twice?
streamstats count count(eval...)
(I used this code snipped from another Splunk answer)
The first counts all events and the second counts only those events where EventCode=4740.
What is your inputs.conf
for this?
Are your indexers using NTP? Do you have the TZ settings correct for this input?
My time zone settings are correct, as other inputs are correctly recording time.
If I remove most of the search string like this
index=wineventlog Account_Domain=* | table _time
The time shows up perfectly.
When I add in the | stats part is when it seems to break
index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740") | stats count count(eval(EventCode=4740)) as LockedCount by user Account_Domain | table _time
Shows no results