Splunk Search
Highlighted

Count Consecutive Failed Logins Events

Explorer

We have our test environment in which Splunk Enterprise OVA is installed as server and Windows server (with universal forwarder installed) which is client. From these windows server all the logs are forwarder. I want to find the the consecutive failed logins events within the time span of 1 min. If a next event is successful logon in the middle of the failed logins, it should ignored. Each event has a field which tells whether it was success or failure.

For Ex: I have tried using the below query.

1. index=wineventslog EventCode=4625 | eval Result=if((EventCode=4625), "FAILED", "SUCCESSFUL") | streamstats count timewindow=1m | table AccountName,Result,dest,ComputerName | dedup Account_Name

2. index=wineventslog EventCode=4625 | streamstats count timewindow=1m | table AccountName,action,dest,ComputerName | dedup Account_Name

Any help to resolve this issue.
Thanks

Highlighted

Re: Count Consecutive Failed Logins Events

Legend

Hi Sagar0511,
if you want all the failed login in a minute, you could use a search like this:

index=wineventslog EventCode=4625 
| stats values (Account_Name) AS Account_Name values(dest) AS dest values(ComputerName) AS ComputerName count 

If you want to know the login failed for each Account_Name you can add the clause BY at the end of the search

index=wineventslog EventCode=4625 
| stats values (Account_Name) AS Account_Name values(dest) AS dest values(ComputerName) AS ComputerName count BY Account_Name

If instead a saccessful login resets the count you can use something like this:

index=wineventslog EventCode=4624 OR EventCode=4625 
| transaction startswith="EventCode=4625" endswith="EventCode=4624"
| table Account_Name dest ComputerName eventcount

If a saccessful login resets the count and you want the count for user you can use something like this

index=wineventslog EventCode=4624 OR EventCode=4625 
| transaction Account_Name startswith="EventCode=4625" endswith="EventCode=4624"
| table Account_Name dest ComputerName eventcount

Bye.
Giuseppe

0 Karma
Highlighted

Re: Count Consecutive Failed Logins Events

Explorer

above answer is not valid for consecutive failed attempts

0 Karma