We use Workday as our payroll system and have a Workday add-on with logs in an index called dmc_workday_index. I want to see the attempts over 5 to change direct deposit information within Workday that are coming from unknown source IP's. We thought something like below which works except for the last part referring to the != expression. I want something more efficient anyway. Hoping someone has a few good suggestions. index=dmc_workday_index taskDisplayName="Manage Payment Elections" | stats count by ipAddress | where (count > 5) ipAdress != "64.147.0.0/16" ... View more

I am new to Splunk and have been tasked with creating a dashboard that will show detail about account lockout events. Specifically when an administrator account has been locked out, why and on what device. I don't need anything fancy right now just something that works and I can add more to it later. I have evaluated other answers to similar questions and can't seem to get any of them to work but they also seem to be more complex and I can't decipher them yet because of my limited splunk knowledge. ... View more