Splunk Search
Highlighted

display results only above certain number

Explorer

I have this search I want to only display results for when the sum(failures) is higher than 4 how can I do this?

(index=infrastructure-os OR index=main) sudo "incorrect password attempt*" 
|rex field=_raw "sudo:[^a-z]+(?<user>[^ ]+) : (?<failures>[0-9]+) incorrect"
|stats sum(failures) by user, host 
| where user!="addm"| 
Tags (1)
0 Karma
Highlighted

Re: display results only above certain number

Legend

Try this!

(index=infrastructure-os OR index=main) sudo "incorrect password attempt*" 
| rex field=_raw "sudo:[^a-z]+(?<user>[^ ]+) : (?<failures>[0-9]+) incorrect"
| stats sum(failures) as totalFailures by user, host 
| where user!="addm" AND totalFailures > 4

Notice that you can give a name to the results of the stats calculation. Once it has a field name (totalFailures), you can use it in further commands...

View solution in original post

Highlighted

Re: display results only above certain number

Explorer

That worked! Thanks

0 Karma