- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
mikefoti
Communicator
01-24-2023
11:01 AM
Given web access log data with following fields:
_time, http_status, src_ip, dest_ip
After a bruteforce attack on a login page, where http_status of 200=success and 401=failure, how can I display the number of failures, plus earliest(_time) and latest(_time) by src_ip
I've tried using streamstats like below, but do not get what I'm looking for
index=myIndex AND status=*
| table _time status src_ip dest_ip
| sort + _time
| streamstats reset_on_change=true count earliest(_time) AS ET latest(_time) AS LT by status
| convert ctime(ET) ctime(LT)
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
01-24-2023
11:23 AM
index=myIndex AND status=*
| table _time status src_ip dest_ip
| sort + _time
| stats count(eval(status="401")) as count earliest(_time) AS ET latest(_time) AS LT by src_ip
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
01-24-2023
11:23 AM
index=myIndex AND status=*
| table _time status src_ip dest_ip
| sort + _time
| stats count(eval(status="401")) as count earliest(_time) AS ET latest(_time) AS LT by src_ip
