Splunk Search

Count Consecutive Failed Logins Events

Sagar0511
Explorer

We have our test environment in which Splunk Enterprise OVA is installed as server and Windows server (with universal forwarder installed) which is client. From these windows server all the logs are forwarder. I want to find the the consecutive failed logins events within the time span of 1 min. If a next event is successful logon in the middle of the failed logins, it should ignored. Each event has a field which tells whether it was success or failure.

For Ex: I have tried using the below query.

1. index=wineventslog EventCode=4625 | eval Result=if((EventCode=4625), "FAILED", "SUCCESSFUL") | streamstats count time_window=1m | table Account_Name,Result,dest,ComputerName | dedup Account_Name

2. index=wineventslog EventCode=4625 | streamstats count time_window=1m | table Account_Name,action,dest,ComputerName | dedup Account_Name

Any help to resolve this issue.
Thanks

Rishabh_McKc
Explorer

above answer is not valid for consecutive failed attempts

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Sagar0511,
if you want all the failed login in a minute, you could use a search like this:

index=wineventslog EventCode=4625 
| stats values (Account_Name) AS Account_Name values(dest) AS dest values(ComputerName) AS ComputerName count 

If you want to know the login failed for each Account_Name you can add the clause BY at the end of the search

index=wineventslog EventCode=4625 
| stats values (Account_Name) AS Account_Name values(dest) AS dest values(ComputerName) AS ComputerName count BY Account_Name

If instead a saccessful login resets the count you can use something like this:

index=wineventslog EventCode=4624 OR EventCode=4625 
| transaction startswith="EventCode=4625" endswith="EventCode=4624"
| table Account_Name dest ComputerName eventcount

If a saccessful login resets the count and you want the count for user you can use something like this

index=wineventslog EventCode=4624 OR EventCode=4625 
| transaction Account_Name startswith="EventCode=4625" endswith="EventCode=4624"
| table Account_Name dest ComputerName eventcount

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...