Splunk Search

looking for unknown but equal field values across single search

aanetserv
New Member

I'm doing a search for invalid logons for our vpn logs. But I want the search results to return when the invalid attempts reach 5 or more from the same user but I don't know the user ahead of time. If a user has 5 or more invalid logon attempts, I want it to alert. Right now I can get all the invalid attempts from all users in the time frame I'm looking at but I don't know how to narrow that down to just alerting on if one user has 5 or more attempts. Please help. Thanks.

Tags (1)
0 Karma
1 Solution

thall79
Communicator

Have you tried attaching the following to your search (you will need to replace user with the field that represents your failed user)

"your search here" | stats count by user | search count > 4

This should filter the failed users to only show ones that have failed 5 times or more.

travis.

View solution in original post

thall79
Communicator

Have you tried attaching the following to your search (you will need to replace user with the field that represents your failed user)

"your search here" | stats count by user | search count > 4

This should filter the failed users to only show ones that have failed 5 times or more.

travis.

aanetserv
New Member

Thanks, that's what I was looking for, it worked.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...