Getting Data In

Windows Failed Login Top Ten count

aberdamy
Explorer

I am trying to get the top 10 Failed Login count by User. The problem is that Windows 2008 uses "Account_Name" and Windows 2003 uses "User_Name" so I've used eval to combine the two fields but I am also using rex to go to the second instance of the Account_Name in the Windows 2008 event. The rex expression doesn't seem to work when I throw eval in there. Below is my search string, any suggestions?

source="WinEventLog:Security" EventCode="4625" OR EventCode="529" |eval USER=coalesce(Account_Name,User_Name) | rex "(?ms)Account For Which Logon Failed.+?Account Name:\s+(?\V+)" |stats count by USER |sort -count |head 10

0 Karma

aberdamy
Explorer

Solution:

source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex field=_raw max_match=99 "Account Name:\s+(?\w+\$?)" | eval UserName=coalesce(User_Name,Account_Name) | stats count by UserName |sort -count |head 10

aberdamy
Explorer

yes, appears to have worked. Of course, as you can see the rex has been changed as well

0 Karma

somesoni2
SplunkTrust
SplunkTrust

So max=99 in rex command did it?

0 Karma

aberdamy
Explorer

Sorry I miss-typed that last one, the correct search string is below. I get results however it is missing the "4625" events. Conversely, if I rename as User_Name it does not include the "529" events

source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex "(?ms)Account For Which Logon Failed.+?Account Name:s+(?V+)" |rename User_Name as Account_Name |stats count by Account_Name |sort -count |head 10

0 Karma

aberdamy
Explorer

thank you for your reply, unfortunately putting |eval after rex did not work and using the rename function did not produce any results:

source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex "(?ms)Account For Which Logon Failed.+?Account Name:s+(?V+)" |rename User_Name as Account_Name |stats count by USER |sort -count |head 10

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Does the rex work if you don't use eval? If yes then you can try moving eval after rex.

Another option you can try is to that instead of eval USER, use '|rename User_Name as Account_Name | ...| stats count by Account_Name'.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...