Splunk Search

Windows EventLogs: 3 failed logins from 3 different users from same host

Fe-atSplunk
Explorer

Using Windows EventCodes I want to find 3 or more users failing to log in. So far my syntax is 

| stats values(user) as user count by host

which looks good. Now I only want to see > 2 users from the same host. | where count > 2 counts the total, not the different values in the "user" field. 

 

Labels (2)
0 Karma

Fe-atSplunk
Explorer

It was the dc I was missing, so thanks for your response!

0 Karma

PickleRick
SplunkTrust
SplunkTrust

If your search is indeed literarily as you wrote it:

| stats values(user) as user count by host

Then you're getting two different stats values per host - one is a multivalue single field containing all the users for this host, the second one is a sum of all events for this host.

That's probably not what you wanted.

You might list the values and count it afterwards:

| stats values(user) as users by host | eval usercount=mvcount(users)

But it's not very pretty

Or you might use dc(user)

| stats values(user) as users dc(user) as usercount by host
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...