Splunk Search

Windows security events search

lohit
Path Finder

I have to capture the failed login attempts over windows machines.
I am filtering on the basis of EventCode=4625.
For a particular User,I am getting multiple events for a time event, like failed events for a user are coming around 10-11 in 1 minute.
Please help me with this search so that I can remove all the redundancy of user names like "-".
I want to display 4 fields- user name, last login, host, total count of failed events

Tags (1)
0 Karma

splunk68
Path Finder

You could try something like this:

index="MyIndex" EventCode="4625" | eval Username=(mvindex(Account_Name,1)) | stats count by Username,host | table Username,host,count

Regarding "last login",you could simply do a search like:

index="MyIndex" EventCode="4625" | eval Username=(mvindex(Account_Name,1)) | dedup Username | table _time,Username,host

I guess combining "last login" with the count of failed events is a little bit tricky. You could try appending a search.

lukejadamec
Super Champion

What you are seeing is the effect of having two fields named Account Name. The count for - will equal the sum of all other Account Names.

Use this to check the first entry for a value, and if its null then get the second entries value:

eval User = if(isnull(Account_Name), User_Name, mvindex(Account_Name,1))

This will create the new value User, but you will probably have to 'View all fields' to see it.
The User field will not contain -.

You can find more information here:
http://answers.splunk.com/answers/2649/same-fields-with-different-values-in-one-event

MarioM
Motivator

Why not using the windows app and AD app?

Splunk for Windows

Splunk for Active Directory

They have those kind of searches/reports and you can add yours too.

0 Karma

lohit
Path Finder

i am asked to make a self search for this.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...