Count Consecutive Failed Logins Events

[Sagar0511]

We have our test environment in which Splunk Enterprise OVA is installed as server and Windows server (with universal forwarder installed) which is client. From these windows server all the logs are forwarder. I want to find the the consecutive failed logins events within the time span of 1 min. If a next event is successful logon in the middle of the failed logins, it should ignored. Each event has a field which tells whether it was success or failure.

For Ex: I have tried using the below query.

1. index=wineventslog EventCode=4625 | eval Result=if((EventCode=4625), "FAILED", "SUCCESSFUL") | streamstats count time_window=1m | table Account_Name,Result,dest,ComputerName | dedup Account_Name

2. index=wineventslog EventCode=4625 | streamstats count time_window=1m | table Account_Name,action,dest,ComputerName | dedup Account_Name

Any help to resolve this issue.
Thanks

[Rishabh_McKc]

above answer is not valid for consecutive failed attempts

[gcusello]

Hi Sagar0511,
if you want all the failed login in a minute, you could use a search like this:

index=wineventslog EventCode=4625 
| stats values (Account_Name) AS Account_Name values(dest) AS dest values(ComputerName) AS ComputerName count 

If you want to know the login failed for each Account_Name you can add the clause BY at the end of the search

index=wineventslog EventCode=4625 
| stats values (Account_Name) AS Account_Name values(dest) AS dest values(ComputerName) AS ComputerName count BY Account_Name

If instead a saccessful login resets the count you can use something like this:

index=wineventslog EventCode=4624 OR EventCode=4625 
| transaction startswith="EventCode=4625" endswith="EventCode=4624"
| table Account_Name dest ComputerName eventcount

If a saccessful login resets the count and you want the count for user you can use something like this

index=wineventslog EventCode=4624 OR EventCode=4625 
| transaction Account_Name startswith="EventCode=4625" endswith="EventCode=4624"
| table Account_Name dest ComputerName eventcount

Bye.
Giuseppe