Security

Only Failed Users without Any other Successful attempts

moayadalghamdi
Path Finder

Hello Splunkers

 

i want to print events for only the users who has failed login attempts but never allowed attempts.

here's my search index=MyApp eventype=authentication action=fail user=*

but this one prints all failures even if they have other successful attempt.

i only want users with only failed attempts without other successful attempts, i hope the picture below clears things:

moayadalghamdi_0-1625999468283.png

green: user only have successful logins

Yellow: user have both successful/failed logins

Red: user only have failed logins

 

i want the red area only

 

Thanks

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="user,attempt
A,success
B,fail
B,success
C,fail
A,success
B,fail
B,success
C,fail"
| multikv forceheader=1 
| fields - _* linecount



| stats values(attempt) as attempt dc(attempt) as count by user
| where attempt="fail" AND count = 1

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="user,attempt
A,success
B,fail
B,success
C,fail
A,success
B,fail
B,success
C,fail"
| multikv forceheader=1 
| fields - _* linecount



| stats values(attempt) as attempt dc(attempt) as count by user
| where attempt="fail" AND count = 1

moayadalghamdi
Path Finder

another help Mr. Whisperer

 

i want to show this value as a single count to show it in a "single value" visualization.

 

Thanks again ^_^ 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Which count? The count of users who failed or the count of failures (by user or total)?

moayadalghamdi
Path Finder

Hello.

 

i had 27 results of distinct users who never had a successful login, i want those 27 results as a single count value

moayadalghamdi_0-1626070072049.png

 

i want to show it like this

moayadalghamdi_1-1626070183613.png

 

this is a 3d search with span=1d, i want something similar.

 

 

thanks ^_^

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Add

| stats count

to the end to get the 27

moayadalghamdi
Path Finder

sorry but i need it in timechart, so i can see the changes overtime.

 

i used 

| timechart count

and

| timechart span=1d count

 

but no statistics neither visuals was shown.

 

pleas help with it, thanks ^_^

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It would help if you were clear from the outset what the full requirement was! Try this:

| bin _time span=1d
| stats values(attempt) as attempt dc(attempt) as count by _time user
| where attempt="fail" AND count = 1
| stats count by _time

moayadalghamdi
Path Finder

sorry but its not working.

 

here's the search.

moayadalghamdi_1-1626072690959.png

 

and here's the search with the count by _time

moayadalghamdi_0-1626072655451.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That isn't the search with _time that I suggested - you need to bin the time into days, add it to the first stats so that _time in available for the second stats. Please read and implement the suggestions carefully before saying they don't work. I can't guarantee to get it right every time, but if you don't try what is suggested, how will we know if it works or not?

moayadalghamdi
Path Finder

sorry for that, i took the wrong screen shot.

 

here's the actual screenshot with the bin command.

moayadalghamdi_0-1626073274273.png

 

im so sorry to bother you.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
Spoiler
You still haven't got the _time on the first stats!

moayadalghamdi
Path Finder
Spoiler
it worked!

thanks man, you're the best !
0 Karma

moayadalghamdi
Path Finder

you really deserve the rank LEGEND 

 

Thanks a lot ^_^

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...