Splunk Search

How to find out failed login attempts with (Event Code=4625) which will happen more than 6 times with in one hour?

90509
Engager

Hi All,

I would like to find out failed login attempts happen more than 6 times with in 1hr time span.So here the main thing is the data come up with Events codes(Event Codes=4638,4722,4720) each and every time when we run a search in search bar.

event code 4625 should be separate from all the other event codes. Because 4625 is the only event code where we look for more than 6 failed attempts. The other three event codes we need to see each time they happen.
could anyone please assist me how to pull the 3 event codes every except event code:4625

Below is my search::

index=".........." AND sourcetype=".........." AND tag="....." AND NOT ((user=null) OR (tag=.............)) AND EventCode=4625 OR (EventCode=4720 OR EventCode=4722 OR EventCode=4738)
| fillnull value="N/A"
| bin _time span=1hr as HourDay
| eval hourDay=strftime(HourDay,"%m-%d-%y %H:%M:%S")
| stats count last(hourDay) as timestamp by user, HourDay, EventCode, Account_Domain, Account_Name, dvc_owner,dvc_bunit,dvc_ip, subject, dvc,
| where count>6
|fields - HourDay
| search NOT
[| inputlookup ........csv
| rename service_accounts as user]

Tags (1)
0 Karma

90509
Engager

I hope the logic is correct but I don't know I am getting error like "Error in 'multisearch' command: Multisearch subsearches may only contain purely streaming operations (subsearch 1 contains a non-streaming command.)"

0 Karma

sandeepmakkena
Contributor

| multisearch
[ search ndex=".........." AND sourcetype=".........." AND tag="....." AND NOT ((user=null) OR (tag=.............)) AND EventCode=4625
| fillnull value="N/A"
| bin _time span=1hr as HourDay
| eval hourDay=strftime(HourDay,"%m-%d-%y %H:%M:%S")
| stats count last(hourDay) as timestamp by user, HourDay, EventCode, Account_Domain, Account_Name, dvc_owner,dvc_bunit,dvc_ip, subject, dvc,
| where count>6
| fields - HourDay
| search NOT
[| inputlookup ........csv
| rename service_accounts as user]
| eval event=event/2]
[ search
[ search ndex=".........." AND sourcetype=".........." AND tag="....." AND NOT ((user=null) OR (tag=.............)) AND EventCode=4720 OR EventCode=4722 OR EventCode=4738
| fillnull value="N/A"
| bin _time span=1hr as HourDay
| eval hourDay=strftime(HourDay,"%m-%d-%y %H:%M:%S")
| stats count last(hourDay) as timestamp by user, HourDay, EventCode, Account_Domain, Account_Name, dvc_owner,dvc_bunit,dvc_ip, subject, dvc,
| where count>1
| fields - HourDay
| search NOT
[| inputlookup ........csv
| rename service_accounts as user]

This should work.

0 Karma

sandeepmakkena
Contributor

Did this work ?

0 Karma

90509
Engager

no the second part of the search not working

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...