Splunk Search

Create Splunk Query aggregating failed log in events

sahiltcs
Path Finder

I looking query where I can see the aggregation of failed log in events

Can you please share the query and details for how to see fail log in events

Tags (1)
0 Karma
1 Solution

dkeck
Influencer

HI,

what kind of events do you have? splunk internal? windows event code?

for splunk : index=_audit action=failure | stats count by _time,user,action

for windows eventcode

index=yourindex
 sourcetype="WinEventLog:Security" 
 EventCode=4625
 |fillnull value=NULL
 | eval Account_Name = mvindex(Account_Name,1) 
 | eval Security_ID = mvindex(Security_ID,1) 
 | eval LoginType=case(Logon_Type=3,"RPC (not RDP)",Logon_Type=4,"Batch",Logon_Type=5,"Service",Logon_Type=7,"Screen Unlock/Session Resume",Logon_Type=10,"Remote Desktop",Logon_Type=11,"Cached",Logon_Type=9,"New Credentials")
 |stats count(Security_ID) as "Login Events" by Security_ID, Account_Name, LoginType,host,_time  |sort + Security_ID

View solution in original post

0 Karma

dkeck
Influencer

HI,

what kind of events do you have? splunk internal? windows event code?

for splunk : index=_audit action=failure | stats count by _time,user,action

for windows eventcode

index=yourindex
 sourcetype="WinEventLog:Security" 
 EventCode=4625
 |fillnull value=NULL
 | eval Account_Name = mvindex(Account_Name,1) 
 | eval Security_ID = mvindex(Security_ID,1) 
 | eval LoginType=case(Logon_Type=3,"RPC (not RDP)",Logon_Type=4,"Batch",Logon_Type=5,"Service",Logon_Type=7,"Screen Unlock/Session Resume",Logon_Type=10,"Remote Desktop",Logon_Type=11,"Cached",Logon_Type=9,"New Credentials")
 |stats count(Security_ID) as "Login Events" by Security_ID, Account_Name, LoginType,host,_time  |sort + Security_ID
0 Karma

sahiltcs
Path Finder

Hello,

We have Windows Based events code , Thanks for the query let me verify and get back to you.

Thanks,
Sahil

0 Karma

sahiltcs
Path Finder

hi,

Actually I need to check how to identify all technical accounts that are not automatically locked after 5 consecutive failed log in attempts, Is the above query will help to check failed log in events

Thanks,
Sahil

0 Karma

dkeck
Influencer

Post a new question for that

0 Karma

sahiltcs
Path Finder

Posted Help with the query

0 Karma
Get Updates on the Splunk Community!

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...