Splunk Search

Is this the correct way to extract successful and failed logins from /var/log/secure in a search?

sureshsala
Explorer

I need help with the regular expression for field extraction of login status:

Successful:

source="/var/log/secure" | rex field=_raw " user (?[^ ]+)"| search user="*" | chart count BY host,user 

Failed:

source="/var/log/secure" | rex field=_raw " invalid user (?[^ ]+)"| search user="*" | chart count BY host,user 

Is this the right way to do it, or there is a better way?

Please help.

0 Karma
1 Solution

somesoni2
Revered Legend

Assuming your regex is correctly extracting the users, I would try like this (I would always throw the index and sourcetype as well)

Successfull

index=yourIndex sourcetype=yourSourcetype source="/var/log/secure" "session opened for user " | rex field=_raw "session opened for user (?<user>[^ ]+)"  | chart count BY host,user

Failed

index=yourIndex sourcetype=yourSourcetype  source="/var/log/secure" fail OR invalid | rex field=_raw " invalid user (?<user>[^ ]+)" | chart count BY host,user 

View solution in original post

somesoni2
Revered Legend

Assuming your regex is correctly extracting the users, I would try like this (I would always throw the index and sourcetype as well)

Successfull

index=yourIndex sourcetype=yourSourcetype source="/var/log/secure" "session opened for user " | rex field=_raw "session opened for user (?<user>[^ ]+)"  | chart count BY host,user

Failed

index=yourIndex sourcetype=yourSourcetype  source="/var/log/secure" fail OR invalid | rex field=_raw " invalid user (?<user>[^ ]+)" | chart count BY host,user 

sureshsala
Explorer

@somesoni2 Awesome, thanks a lot but failed regex is added NULL user and I am unable to figure out.

0 Karma

sureshsala
Explorer

Answer:

source="/var/log/secure" input_userauth_request AND (fail OR invalid) | rex field=_raw " invalid user (?[^ ]+)" | chart count BY host,user
0 Karma

sundareshr
Legend

What does the log entry look like? Can you share one event with successful logon and one with failed logon?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...