Splunk Search

How to make a report with TOP and Table?

rafaelschwed
New Member

I would put in the same report the "TOP logon failures" and below the table with _time and all failures.

The TOP search:

action=failure eventtype="Logon Failure" NOT | top user Source_Network_Address Workstation_Name ComputerName | rename user as User, ComputerName as Destination | where count > 30
Tags (4)
0 Karma
1 Solution

fdi01
Motivator

you can do it in an dashboard with two panels
first panel you put the "TOP logon failures"
and second panel you the table with _time and all failures.

View solution in original post

fdi01
Motivator

you can do it in an dashboard with two panels
first panel you put the "TOP logon failures"
and second panel you the table with _time and all failures.

View solution in original post

rafaelschwed
New Member

Good idea. I will do this.
But there is some form of a query and bring TOP Table?

0 Karma

jplumsdaine22
Influencer

A simple way would be to use a subsearch

action=failure eventtype="Logon Failure" [action=failure eventtype="Logon Failure" | top user Source_Network_Address Workstation_Name ComputerName | search count > 30 | fields user]

Alternatively combine the two

action=failure eventtype="Logon Failure" | stats values(_time) count by  user,Source_Network_Address,Workstation_Name,ComputerName | search count > 30 

jplumsdaine22
Influencer

Good idea. Be sure to have a look at the Splunk tutorial here: http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchTutorial/WelcometotheSearchTutorial

It has a section on how to make dashboards.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!