Splunk Search

More than 10 accounts disabled within five minutes.

weetabixsplunk
Explorer

Hi guys,

I'm working on a search that shows more that 10 accounts disabled within a five minute time frame. I feel like the dumbest girl on earth. I know my search works for the most part as the events tab shows the exact amount of events that occurred within that period of time, however, the statistics tab does not display a table:

index=wineventlog EventCode=4725
| bin span=5m _time
| stats count(user), values(user) by _time EventCode
| where count > 10

I also tried
index=wineventlog EventCode=4725
| bin span=5m _time
| table user, Time 
| search count > 10

Any help would be much appreciated.

Thanks

 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=wineventlog EventCode=4725
| bin span=5m _time
| stats count, values(user) by _time EventCode
| where count > 10
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...