Splunk Search

Multiple Login Failure Attempts

mihall
Path Finder

How can I search for 10 failed logon attempts within a 5 minute timeframe?
I could try timechart, but a 24 hour period does not allow the interval to be as small as 5 mins. I could also "stats count by user", but this does not show any aspect of time.

0 Karma

woodcock
Esteemed Legend

Like this:

... | streamstats time_window=5m count(failed_logins) AS failed_logins BY user | where failed_logins >=10

DalJeanis
SplunkTrust
SplunkTrust

@woodcock - Since he mentioned stats count by user I think he wants ten failed logins for a single user...

0 Karma

mihall
Path Finder

No I'm actually looking for all failed logins by users. >10 was the most important part. Thanks

0 Karma

woodcock
Esteemed Legend

Updated, thank you @DalJeanis.

0 Karma

sbbadri
Motivator

try this

| timechart span=5m count(failed_logins) as failed_logins | where failed_logins <=10

0 Karma

woodcock
Esteemed Legend

I think: s/</>/

0 Karma
Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...