Stats vs StreamStats to detect failed logins with 5 mins time frame

[neerajs_81]

All, 
I have a simple requirement to list failed login attempts from same src_ip in a span of 5 mins.  i have seen 2 options in the community here one using stats and other using streamstats.  Which one is more accurate ? @ITWhisperer 

index=XYZ sourcetype=ABC eventName=*Get* errorCode!=success 
| bin _time span=5m
| table _time host eventName, app, command, dest, errorCode, region, userName, user_type, user, src_ip
| stats values(*) as *, count by src_ip
| where count>=5

OR

index=XYZ sourcetype=ABC eventName=*Get* errorCode!=success 
| streamstats time_window=5m count as failed_attempts by src_ip
| where failed_attempts > 5
| table _time user failed_attempts src_ip dest host eventName app command, dest errorCode region userName 

[PickleRick · Accepted solution]

There is often more than one way to get what you want with SPL.

But in this case there is a subtle difference in how those searches work.

The one with | bin time | stats (which is not a great idea BTW, that's what timechart is for) counts occurences within buckets which have fixed boundaries.

The other one works using a sliding window.

So if you had your matching events occuring at - for example - 10:48, 10:49, 10:50, 10:51, 10:52, the second search would find them because they are all within a 5-minute window but the first search wouldn't because three of them would fall into on bucket while two others would fall into another one. And each bucket would list less events than 5.