Splunk: How to find matching IPs that were accepted and failed for SSH login - splunk

Question

I'm interested in searching though this huge batch of /var/log/secure files for all ip-addresses that were accepted AND failed during the SSH log in process.
How do I write a search query that handles this?

Answer 1

Note: Tested on Splunk Enterprise 6.2.2 against my own CentOS 7 Linux server
I did not assume any fields have been extracted in this. My secure logs provide for two distinct messages for successful and failed logins. They look like this:
Mar 24 13:03:59 localhost sshd[3588]: Failed password for adrian from 172.20.255.111 port 4753 ssh2
Mar 24 12:52:41 localhost sshd[2762]: Accepted password for adrian from 172.20.255.111 port 4656 ssh2
With this, I came up with the following search:
source="*secure" process=sshd "password for"
| rex field=_raw "(?<result>Accepted|Failed) password for (?<username>\w+) from (?<ipaddr>[0-9A-Fa-f:\.]+)"
|eval success=if(result=="Failed",0,1)
|stats count as total,sum(success) as success by ipaddr
|where total!=success AND success!=0
The rex does the field extrations generating fields result, username and ipaddr. The success field is 1 if the result field is not Failed. Since the regex only accepts values Accepted or Failed, this means Accepted, but you could change the regular expression for your environment to change that. I then do a typical stats and figure out where the total number of connections is not the same as the successful connections AND the successful connections are non-zero (to match your AND query).