Hello Splunk Community ! I have an alert setup to report failed login attempts by a user > 4 times in 5 minutes. Alert query : index=win_os sourcetype="Security" EventCode=4625 | bin span=5m _time| stats count dc(user) by _time, user, Logon_Type,dest, src, Failure_Reason | where count > 3 | sort user | table _time, user, count, Logon_Type,dest, src, Failure_Reason Alert settings: Alert Type: Scheduled. Hourly, at 0 minutes past the hour. Trigger Condition: Number of Results is > 0 Issue : the last time this alert ran, i got results only from 3 PM attempts. the alert PDF did not report the results from 2:55 PM. Actual Query result: Alert PDF that came in email: Any idea why the complete results were not shown from 2:55 PM when the alert triggered at the hour ?
... View more
