Splunk Search

How to search for the count of failed logins in a 10 minute span where a log has 9 or more rejects and an accept at the end?

ThomasLeroy
Explorer

Hello,

I'm trying to count the number of failed logins in a 10 min span. Here is my search:

host=.." AND gateway_username != "''" | transaction fields="src_ip,gateway_username" startswith="'ZV_REJECT'" endswith="'ZV_ACCEPT'" manspan=10m

How can I search for a log with 9 rejects or more and an accept at the end ?

Best regards
Thomas

Tags (3)
1 Solution

somesoni2
Revered Legend

How about this? Assuming there is a field called "Status" which will have values like ZV_REJECT AND ZV_ACCEPT.

host=.." AND gateway_username != "''" | transaction fields="src_ip,gateway_username" startswith="'ZV_REJECT'" endswith="'ZV_ACCEPT'" maxspan=10m | where eventcount>9 AND mvcount(Status)=2

View solution in original post

somesoni2
Revered Legend

How about this? Assuming there is a field called "Status" which will have values like ZV_REJECT AND ZV_ACCEPT.

host=.." AND gateway_username != "''" | transaction fields="src_ip,gateway_username" startswith="'ZV_REJECT'" endswith="'ZV_ACCEPT'" maxspan=10m | where eventcount>9 AND mvcount(Status)=2

ThomasLeroy
Explorer

That's exactly what i want. Thank you 🙂

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>