Splunk Search

How to use Windows event logs to alert for the failed attempts less than 5 occurring for every hour?

kiran331
Builder

Slow and Low attack? How to use Windows event logs to alert for the failed attempts less than 5 occurring for every hour?

index=wineventlog  EventCode=4625
0 Karma

troyward
Explorer

Might consider using transactions.

index=wineventlog  EventCode=4625
| transaction <username field> maxspan=1h
| where eventcount < 5
| table <username> first last eventcount
0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...