Splunk Search

How to search for 5 failed logins followed by 1 successful login from one user to find brute force attacks?

Path Finder

Dear Experts,

Kindly help to create a search for 5 failed logins followed by 1 successful login from one user.

Interesting fields = user(Username) , action(Success Or Failed)

index=* | ....

Thanks in advanced

0 Karma


In case, you are using the Common Information Model, then you can start your search as tag=Authentication. This will invoke the data from across all "relevant" indexes and will be much faster in returning results.


Hi sumit29,

Can you try the following?

index=* | stats list(Action) as Attempts, count(eval(match(Action,"Failed"))) as Failed, count(eval(match(Action,"Success"))) as Success by Username | where mvcount(Attempts)>=6 AND Success=1 AND Failed>=5
0 Karma

Path Finder

HI Murali,

What if there would be multiple success events after 5 failed attempts? if that happens , success always will be greater than 1 then search returns 0 results. how to deal with this situation?

0 Karma


Thanks. That works.

0 Karma

New Member

That does seem to work, but it doesn't take the time sequence in consideration , how can I order the events in order of time? I first want to see 5 failed loggings followed by a successful login, and not 6 total loggings where there is a successful login in between somewhere

0 Karma


In how many mins, do you want to see the failed login followed by successful logon? if you schedule the above search within that time frame, it should help in you in what you need. Alternatively, you could also use streamstats to get the running total for a given period.

0 Karma

New Member

I have already added a time field (10 minutes), but it seems this query searches in the given timeframe and looks for the total failed and one successful event, without taking the time sequence in which order they came.
for example, I run the query and see users who have logged in this sequence:
1. failure
2. success
3. failure
4. failure
5. failure
6. failure

The query should only look for the first 5 failed loggings followed by a successful, but
it looks in total of loggings within a timeframe

wonder if this is easy to do with the enterprise security app, there you do have brute force queries but none of them contain the successful brute force attacks

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...