Splunk Search

How to do the query for jumpcloud - bruteforce from svchost?

Izz-
New Member

index=* success="false" process_name="C:\\Windows\\System32\\svchost.exe"
| stats count as failedAttempts by user
| sort -failedAttempts

index=* success="false" process_name="C:\\Windows\\System32\\svchost.exe"
| timechart count by user
| sort by _time

I tried do both query but I'm stuck...Need any guidance, thank you 🙂

Labels (1)
0 Karma

woodcock
Esteemed Legend

Your fields are not correct.  You did not show us sample event data.  You did not tell us what "thing' generated the data.  You did not tell us what sourcetype it is.  You did not tell us what source it is.  You did not tell us what ModInput you are using.  You did not tell us what TA you are using.

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...