Failed Login Query

[Mmilaham]

Hello,

I am trying to write a query that will display failed logins (Account_Name, Host, Count).

First Query

index=wineventlog EventCode=4625 | top limit=20 Account_Name host  | where count > 9

Con

1. Displays "-" in some of the Account_Name fields 

Pro

1. Displays all the count and host fields correctly.

Second Query

index=wineventlog EventCode=4625  | rex "(?ms)Account For Which Logon Failed.+?Account Name:\s+(?<Account_Name>\V+)" |top limit=30 Account_Name host| where count >=9

Con

Displays all the Account_Name, count and host fields correctly but displays a lot less results on the table compared to the first query.

Pro

Displays all the Account_Name, count and host fields correctly

I need a query that will displays all the Account_Name, count and host fields correctly as well as displays the same amount of results in the first query. Any help is appreciated. Thanks in advance. 

[richgalloway]

Once you start filtering out undesired account names the number of results will change.  Perhaps this is more like what you're looking for.

index=wineventlog EventCode=4625 Account_Name!="-" ```Filter out -```
```Count names```
| stats count by Account_Name host
```Filter out accounts with fewer than 10 failures```
| where count > 9
```Sort in descending order by count and take the top 20 results```
| sort 20 - count

[Mmilaham]

I'm still getting fewer result compared to running the first query. Also some of the Account Name are wrong(It's just displaying the Host name).

[richgalloway]

Like I said, it's not possible to discard some results and still end up with the same number of results.

The stats command should not be returning results with just the host name in them.  Please share your output (sanitized as necessary).