i want to create a search that shows me when an account failed authentication of more than (3) times in a (10) minute period.
tag=authentication sourcetype="juniper:sslvpn" | bin _time span=10m | stats count by user, _time | where count>3
however - that is only from 00:00 to 00:10, 00:10 - 00:20 and so on. it's not really a 10 minute period...
in my sample the last two events should have a count together of 2....
thanks for any help
maybe a good use case for autoregress or delta? Something like this (not really tested)?
| sort 0 user _time
| autoregress _time as prev_time p=2
| autoregress user as prev_user p=2
| fillnull value=0
| eval diff = _time - prev_time
| where diff <= 600 AND user = prev_user
| table _time prev_time user prev_user diff
| convert ctime(prev_time)
Have a look at the
transaction command. You might be able to build a transaction on each user, where the
Here the link for the command reference: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Transaction
After that, just use the
eventcount to evaluate the ones where are greater than 3. Here how I think it'll look:
tag=authentication sourcetype="juniper:sslvpn" | transacion user maxspan=10m | where eventcount>3 | table _time,user
For long periods of time, transaction tends to be more efficient then stream stats as after its 10m away, it knows it can quit tracking things.
With that said, somesoni2's answer could be simplified a bit and for shorter periods of time, it could perform better due to the overhead of the transaction command.
Give this a try
tag=authentication sourcetype="juniper:sslvpn" | table _time user | streamstats current=f window=1 first(_time) as prevTime by user| eval diff=coalesce(prevTime-_time,0) | streamstats current=t window=3 sum(diff) as duration count by user| where count=3 AND duration < 600 | stats count by user | table user