https://community.splunk.com/t5/Security/Top-10-Failed-Login/m-p/577884#M15751 <P>Here is your SPL query, let me know if it works for you.</P><P>index=wineventlog sourcetype="Wineventlog:Security" EventCode=4625 OR EventCode=529 Account_Name!="" | stats count by Account_Name | sort -count | head 10</P><P>Event code 529 to capture failure events from Win 2003 or older versions</P><P>Account_Name!="&lt;put value which doesn't make any sense to you like blank/- etc&gt;</P><P>head 10 - for top 10 results.</P><P>Hope this helps and happy Splunking!</P> Thu, 09 Dec 2021 12:31:33 GMT kkrises 2021-12-09T12:31:33Z https://community.splunk.com/t5/Security/Top-10-Failed-Login/m-p/577761#M15749 <P>Im new to splunk ,&nbsp;</P><P>I created 15 users and had failed login attempts on some of them.</P><P>how can i find the first 10 failed login attempts,with what command can i see this in splunk</P><P>sourcetype="WinEventLog:Security" eventcode 4625| top limit=10 "Account Name"</P><P>I tried it brought all users but how do I integrate the failed part into it, am I walking on the wrong path?</P> Wed, 08 Dec 2021 10:25:19 GMT https://community.splunk.com/t5/Security/Top-10-Failed-Login/m-p/577761#M15749 sittingonion 2021-12-08T10:25:19Z https://community.splunk.com/t5/Security/Top-10-Failed-Login/m-p/577781#M15750 <P>You're on the right path.</P><P>The event should have a field that indicates if the login succeeded or failed.&nbsp; Test that field in your query to include only failures.&nbsp; You'll need to remove the <FONT face="courier new,courier">top</FONT> command to see the full event.</P><P>The query may end up looking something like this:</P><LI-CODE lang="markup">sourcetype="WinEventLog" EventCode=4625 index=wineventlog action=failure | top limit=10 Account_Name</LI-CODE> Wed, 08 Dec 2021 14:00:31 GMT https://community.splunk.com/t5/Security/Top-10-Failed-Login/m-p/577781#M15750 richgalloway 2021-12-08T14:00:31Z https://community.splunk.com/t5/Security/Top-10-Failed-Login/m-p/577884#M15751 <P>Here is your SPL query, let me know if it works for you.</P><P>index=wineventlog sourcetype="Wineventlog:Security" EventCode=4625 OR EventCode=529 Account_Name!="" | stats count by Account_Name | sort -count | head 10</P><P>Event code 529 to capture failure events from Win 2003 or older versions</P><P>Account_Name!="&lt;put value which doesn't make any sense to you like blank/- etc&gt;</P><P>head 10 - for top 10 results.</P><P>Hope this helps and happy Splunking!</P> Thu, 09 Dec 2021 12:31:33 GMT https://community.splunk.com/t5/Security/Top-10-Failed-Login/m-p/577884#M15751 kkrises 2021-12-09T12:31:33Z