https://community.splunk.com/t5/Security/Linux-failed-login-attempts/m-p/99071#M3231 <P>Hi all,</P> <P>What is the search to find out the total failed login attempts in Linux? I donot want to use *nix app for this. I am getting the logs from /var/log/secure.<BR /> Please help.</P> <P>Lohit</P> Tue, 15 Oct 2013 10:06:54 GMT lohit 2013-10-15T10:06:54Z https://community.splunk.com/t5/Security/Linux-failed-login-attempts/m-p/99071#M3231 <P>Hi all,</P> <P>What is the search to find out the total failed login attempts in Linux? I donot want to use *nix app for this. I am getting the logs from /var/log/secure.<BR /> Please help.</P> <P>Lohit</P> Tue, 15 Oct 2013 10:06:54 GMT https://community.splunk.com/t5/Security/Linux-failed-login-attempts/m-p/99071#M3231 lohit 2013-10-15T10:06:54Z https://community.splunk.com/t5/Security/Linux-failed-login-attempts/m-p/99072#M3232 <P>You will want to look at the Search Language guide. This question is very broad, and with no indication of what your data looks like. You could try <CODE>source=/var/log/secure login failed</CODE> and see what happens, but really you should refer to the Search Tutorial and go from there.</P> <P><CODE><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Startsearching" target="test_blank">http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Startsearching</A></CODE></P> Tue, 15 Oct 2013 11:20:47 GMT https://community.splunk.com/t5/Security/Linux-failed-login-attempts/m-p/99072#M3232 alacercogitatus 2013-10-15T11:20:47Z