LOGIN SUCCESS vs LOGIN FAILURE

[MattQ]

I have logs that return the basic text of "LOGIN SUCCESS" and "LOGIN FAILURE" but I don't seem to be able to make this a unique and interesting field. I want to be able to search logs and return a count by IP addresses of everything trying to log in and then sort those with counts by SUCCESS or FAILURE

This seems incredibly simple but I am failing at it

[jtrucks · Accepted solution]

Use a field extraction like:

… | rex field=_raw ".*LOGIN\s(?<loginresult>(SUCCESS|FAILURE)).*"

There may be more elegant ways to do the regex, but that gives you the field named "loginresult" that will have either SUCCESS or FAILURE for each entry. That allows you to do reporting and matching on those fields. If the above works, then use that syntax to create a configured extract so the field is always available for that data source.

[aelliott]

This quick reference guide helped me to get started http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/SearchCheatsheet#Download_the_Splunk...

[MattQ]

This definitely is breathing life into this. With this nudge I am getting there. Thank you

[somesoni2]

Did you tried extracting LOGIN SUCCESS or LOGIN FAILURE using field extraction?

[MattQ]

Here is a scrubbed version. Log Source and Sourcetype are defined and working well. LOGIN FAILURE looks exactly like LOGIN SUCCESS and is just plain text and doesn't return as an interesting field. The IP is out there and I can get a count to return by IP... but then I also want to see if these attempts have a SUCCESS or FAILURE associated.

<13>Nov 7 11:14:36 log source 07-Nov-2013 11:14:36 - LOGIN SUCCESS|User Attempt|0|IP list|xxx.xxx.xxx.xxx

Thank you

[richgalloway]

Would you please provide sample log entries?