looking for unknown but equal field values across single search

[aanetserv]

I'm doing a search for invalid logons for our vpn logs. But I want the search results to return when the invalid attempts reach 5 or more from the same user but I don't know the user ahead of time. If a user has 5 or more invalid logon attempts, I want it to alert. Right now I can get all the invalid attempts from all users in the time frame I'm looking at but I don't know how to narrow that down to just alerting on if one user has 5 or more attempts. Please help. Thanks.

[thall79 · Accepted solution]

Have you tried attaching the following to your search (you will need to replace user with the field that represents your failed user)

"your search here" | stats count by user | search count > 4

This should filter the failed users to only show ones that have failed 5 times or more.

travis.

[aanetserv]

Thanks, that's what I was looking for, it worked.