Unable to get multiple failed logins followed by successful login

[gadepoonam]

In order to get Unable to get multiple failed logins followed by successful login, i have written following search query.

But looks like matchCount is not working fine. The transaction query is able to list the events correctly, but stats is not giving correct count. Plus the number of records written by stats is not correct. I am looking for only those records which have Failed count > 0

index=rhel sourcetype=linux_secure process=sshd | transaction pid host endswith="Accepted password"
| stats count(eval(searchmatch("Failed password"))) as FailedCount by user _time

[somesoni2]

Try this

index=rhel sourcetype=linux_secure process=sshd 
| eval Failed=if(searchmatch("Failed password"),"Failed",null())
| transaction pid host endswith="Accepted password" 
| stats count(Failed) as FailedCount by user _time

[gadepoonam]

Thanks for your response. But I am facing same issue as above with new query.

For example, please find below event log which shows Failed password was entered twice. But stats shows failed count as 1

Event Logs:
7/28/17
8:59:30.000 AM

Jul 28 06:59:30 <> sshd[12314]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=<> user=xyz
Jul 28 06:59:32 <> sshd[12314]: Failed password for xyz from <> port 56814 ssh2
Jul 28 06:59:36 <> sshd[12314]: Failed password for xyz from <> port 56814 ssh2
Jul 28 06:59:43 <> sshd[12314]: Accepted password for xyzfrom 10

Stats:
User _time FailedCount
xyz 2017-07-28 08:59:30 1