topic Re: Need Splunk Query Help - Consultant needed in Splunk Enterprise

Need Splunk Query Help - Consultant needed

GeraldSteve12 — Fri, 26 Sep 2025 13:16:30 GMT

Having trouble with a Splunk search that's supposed to find failed login attempts from our security logs. The search runs without errors but only returns a fraction of the events I know are there.

I can see the failed login events when browsing raw logs, but my search query isn't catching them all. Tried different time ranges and field filters but still missing data. Need someone who knows Splunk search syntax to help fix this.

Need about 2 hours of help to get the search working properly. Have to have this security report ready by Wednesday for our compliance review."

Re: Need Splunk Query Help - Consultant needed

ITWhisperer — Fri, 26 Sep 2025 13:22:50 GMT

What is your current approach?

What is different about the events you are missing?

Re: Need Splunk Query Help - Consultant needed

livehybrid — Fri, 26 Sep 2025 13:56:23 GMT

Hi @GeraldSteve12

Please can you provide the SPL you are using and also give us info (and ideally a sample event) of the data you are searching (eg is this Linux, AWS, azure AD, windows event logs).

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful

Marking it as the solution if it resolved your issue

Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.