Splunk Search

looking for unknown but equal field values across single search

aanetserv
New Member

I'm doing a search for invalid logons for our vpn logs. But I want the search results to return when the invalid attempts reach 5 or more from the same user but I don't know the user ahead of time. If a user has 5 or more invalid logon attempts, I want it to alert. Right now I can get all the invalid attempts from all users in the time frame I'm looking at but I don't know how to narrow that down to just alerting on if one user has 5 or more attempts. Please help. Thanks.

Tags (1)
0 Karma
1 Solution

thall79
Communicator

Have you tried attaching the following to your search (you will need to replace user with the field that represents your failed user)

"your search here" | stats count by user | search count > 4

This should filter the failed users to only show ones that have failed 5 times or more.

travis.

View solution in original post

thall79
Communicator

Have you tried attaching the following to your search (you will need to replace user with the field that represents your failed user)

"your search here" | stats count by user | search count > 4

This should filter the failed users to only show ones that have failed 5 times or more.

travis.

aanetserv
New Member

Thanks, that's what I was looking for, it worked.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...