Getting Data In

Windows Failed Login Top Ten count

aberdamy
Explorer

I am trying to get the top 10 Failed Login count by User. The problem is that Windows 2008 uses "Account_Name" and Windows 2003 uses "User_Name" so I've used eval to combine the two fields but I am also using rex to go to the second instance of the Account_Name in the Windows 2008 event. The rex expression doesn't seem to work when I throw eval in there. Below is my search string, any suggestions?

source="WinEventLog:Security" EventCode="4625" OR EventCode="529" |eval USER=coalesce(Account_Name,User_Name) | rex "(?ms)Account For Which Logon Failed.+?Account Name:\s+(?\V+)" |stats count by USER |sort -count |head 10

0 Karma

aberdamy
Explorer

Solution:

source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex field=_raw max_match=99 "Account Name:\s+(?\w+\$?)" | eval UserName=coalesce(User_Name,Account_Name) | stats count by UserName |sort -count |head 10

aberdamy
Explorer

yes, appears to have worked. Of course, as you can see the rex has been changed as well

0 Karma

somesoni2
SplunkTrust
SplunkTrust

So max=99 in rex command did it?

0 Karma

aberdamy
Explorer

Sorry I miss-typed that last one, the correct search string is below. I get results however it is missing the "4625" events. Conversely, if I rename as User_Name it does not include the "529" events

source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex "(?ms)Account For Which Logon Failed.+?Account Name:s+(?V+)" |rename User_Name as Account_Name |stats count by Account_Name |sort -count |head 10

0 Karma

aberdamy
Explorer

thank you for your reply, unfortunately putting |eval after rex did not work and using the rename function did not produce any results:

source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex "(?ms)Account For Which Logon Failed.+?Account Name:s+(?V+)" |rename User_Name as Account_Name |stats count by USER |sort -count |head 10

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Does the rex work if you don't use eval? If yes then you can try moving eval after rex.

Another option you can try is to that instead of eval USER, use '|rename User_Name as Account_Name | ...| stats count by Account_Name'.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...