About Vantine

Vantine · ‎12-13-2023

Wasnt getting results, so I went longer and smaller errors. Still not getting anything. Here is how I have it index=eits_wineventlog_security sourcetype=WinEventLog EventCode=4771 OR EventCode=4776 | timechart span=60m count by user | where count>5 I know for sure we have had enough failures to at least get a few. Thanks

Vantine · ‎12-13-2023

Trying to set up an alert to show any log in that has had 500 log on failures in under 30 min. Here is what I currently have (with non relevant data changed) index=* sourcetype=* action=failure EventCode=4771 OR EventCode=4776 | bucket _time span=30m | stats count by user | where count>500 I want to make sure this is correct. Thanks!

Posts	2
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎12-13-2023

Online Status	Offline
Date Last Visited	‎12-13-2023 09:10 AM

Correct way to do count over time

Re: Correct way to do count over time

Correct way to do count over time

Join the Conversation

Correct way to do count over time

Re: Correct way to do count over time

Correct way to do count over time