Splunk Search

How to find failed Logons by IP Address and by Username?

Maheshparsi
Explorer

Hi all,

I have some dashboard requirements to be created in "search & reporting app":

  1. failed logons by IPAddress
  2. failed logons by Username
  3. Users Failing to Logon from Multiple IPs

I tried this search, but it is not working:

index=_audit action=failure | stats count by _time,user,action

Can you please help me in finding out the solution?

Thanks in Advance,

Regards,
Mahesh P.

0 Karma
1 Solution

lguinn2
Legend

UPDATED ANSWER: My earlier answer was wrong.

Are you trying to find instances where folks failed to login to Splunk? Because the _audit index only contains audit information about the Splunk environment itself. If you want to see login attempts for Splunk, use this search (Splunk 6.2)

index=_audit  user!=splunk-system-user user!="n/a" action="login attempt"

If you want to track failed Linux logins or failed Windows logins, etc. then you must input the corresponding logs to Splunk. Then write a search that is appropriate for the input.

For example, usually the Linux log will be /var/log/secure. Once you have loaded it into Splunk with the sourcetype linux_secure you can do a search like this to see the failed logins over the last 24 hours.

sourcetype=linux_secure "Failed password" earliest=-24h
| stats count by user src_ip action

View solution in original post

lguinn2
Legend

UPDATED ANSWER: My earlier answer was wrong.

Are you trying to find instances where folks failed to login to Splunk? Because the _audit index only contains audit information about the Splunk environment itself. If you want to see login attempts for Splunk, use this search (Splunk 6.2)

index=_audit  user!=splunk-system-user user!="n/a" action="login attempt"

If you want to track failed Linux logins or failed Windows logins, etc. then you must input the corresponding logs to Splunk. Then write a search that is appropriate for the input.

For example, usually the Linux log will be /var/log/secure. Once you have loaded it into Splunk with the sourcetype linux_secure you can do a search like this to see the failed logins over the last 24 hours.

sourcetype=linux_secure "Failed password" earliest=-24h
| stats count by user src_ip action
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...