Splunk counting duplicate events for failed logon

[bayman]

When the below search is ran, it'll count duplicate failed logons for all users. How do I exclude duplicates in a count?

eventtype=msad-failed-user-logons
(host="*")|fields
_time,signature,src_ip,src_host,src_nt_host,src_nt_domain,user,Logon_Type|stats
count by
user,src_nt_domain,src_ip,|sort
-count|rename user as "Username", src_nt_domain as "Domain", src_ip as
"IP Address"

[lfedak_splunk]

Hey @bayman, if @DalJeanis's solution worked then please don't forget to accept their answer to award karma points and close the question. 🙂

[DalJeanis · Accepted solution]

Try this -

eventtype=msad-failed-user-logons (host="*")
| fields_time, signature, src_ip, src_host, src_nt_host, src_nt_domain, user, Logon_Type
| dedup signature
| stats count by user, src_nt_domain, src_ip,
| sort - count
| rename user as "Username", src_nt_domain as "Domain", src_ip as "IP Address"

Based on the assumption that the dups will have the same signature.

[bayman]

I dedup _time instead and it seemed to work better. Thanks

[DalJeanis]

@bayman - thanks for letting us know what worked. Interesting that the signature might be different between two duplicate events. Must mean something different from what I was guessing.