Splunk Search
Highlighted

How to search for the count of failed logins in a 10 minute span where a log has 9 or more rejects and an accept at the end?

Explorer

Hello,

I'm trying to count the number of failed logins in a 10 min span. Here is my search:

host=.." AND gateway_username != "''" | transaction fields="src_ip,gateway_username" startswith="'ZV_REJECT'" endswith="'ZV_ACCEPT'" manspan=10m

How can I search for a log with 9 rejects or more and an accept at the end ?

Best regards
Thomas

Tags (3)
Highlighted

Re: How to search for the count of failed logins in a 10 minute span where a log has 9 or more rejects and an accept at the end?

SplunkTrust
SplunkTrust

How about this? Assuming there is a field called "Status" which will have values like ZVREJECT AND ZVACCEPT.

host=.." AND gateway_username != "''" | transaction fields="src_ip,gateway_username" startswith="'ZV_REJECT'" endswith="'ZV_ACCEPT'" maxspan=10m | where eventcount>9 AND mvcount(Status)=2

View solution in original post

Highlighted

Re: How to search for the count of failed logins in a 10 minute span where a log has 9 or more rejects and an accept at the end?

Explorer

That's exactly what i want. Thank you 🙂

0 Karma