Splunk Search

How many login attempts can be seen in the logs for username=admin?

ravik453
New Member

I'm trying to complete the lab for my cybersecurity course. I googled few thing for this question, but this question doesn't seem to accept the answer. It is a course from Immersive labs. May be i'm doing something wrong or any problem with my query. I'm not sure.  I've used the query:-

index="_audit" action=* info=*
| stats count by user

Need your help with this to search login attempts for username=admin.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The key to using Splunk is understanding your data. You should examine the log / event data you have available to you to determine which part of the event will help you with your usecase. I suspect this is the purpose of the exercise. You should have been provided with all the necessary information to complete this.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...