Splunk Search

How to create a table that shows multiple failed logins on the same workstation by different usernames?

bakalon
Explorer

Hello,
So I'm looking to a use case where I have to create a table that shows multiple failed logins on the same workstation by different usernames.

Here's what I have so far:

index=windows* sourcetype=WinEventLog:Security EventCode=4625 | eval AccountName=mvindex(Account_Name, 1) | | stats  values(AccountName) by Workstation_Name

That shows all accounts that failed to log in. I want the result where there are multiple failed accounts on the same workstation. So something like ....| where AccountName > 1.

Please let me know if this makes sense. Thanks!

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

index=windows* sourcetype=WinEventLog:Security EventCode=4625 | eval AccountName=mvindex(Account_Name, 1) |  stats  values(AccountName) as Accounts by Workstation_Name | where mvcount(Accounts)>1

View solution in original post

somesoni2
Revered Legend

Try like this

index=windows* sourcetype=WinEventLog:Security EventCode=4625 | eval AccountName=mvindex(Account_Name, 1) |  stats  values(AccountName) as Accounts by Workstation_Name | where mvcount(Accounts)>1

bakalon
Explorer

Dude!!! Thank you very much. I was not aware of the mvcount expression. This worked like a charm. Cheers!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...