Splunk Search

Search for recurring events over multiple time spans

neilsmith2
Explorer

Hi, looking for guidance please on how to alert on recurring auth events over multiple time spans, but I can't get my head around how to construct the search terms

for example:

- user account is locked out =>X per hour for =>X consecutive hours

- user has =>X login failures in an hour for  =>X consecutive  hours 

Hope that makes sense! TIA

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can set up a report which counts the instances by the hour and then use something like streamstats to determine whether the hours with high counts are consecutive.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...