https://community.splunk.com/t5/Getting-Data-In/Failed-Logons-To-Splunk/m-p/29477#M96670 <P>For 6.2.3 below is the location , seems it is NOT logged under ' index=_audit action=failure'</P> <PRE><CODE>index=_internal sourcetype=splunkd ERROR "Login failed" </CODE></PRE> Mon, 04 Jan 2016 16:08:54 GMT stanwin 2016-01-04T16:08:54Z https://community.splunk.com/t5/Getting-Data-In/Failed-Logons-To-Splunk/m-p/29475#M96668 <P>Is there a way to search by failed logons to Splunk?</P> <P>I'd like to create an alert if a user attempts to logon but is denied either because an account doesn't exist, wrong password, etc.</P> <P>Has anyone else tried this?</P> Wed, 08 Aug 2012 16:33:30 GMT https://community.splunk.com/t5/Getting-Data-In/Failed-Logons-To-Splunk/m-p/29475#M96668 peasead 2012-08-08T16:33:30Z https://community.splunk.com/t5/Getting-Data-In/Failed-Logons-To-Splunk/m-p/29476#M96669 <P>Got it</P> <PRE><CODE>index=_audit action=failure </CODE></PRE> <P>or</P> <PRE><CODE>index=_audit action=failure | stats count by _time,user,action </CODE></PRE> Wed, 08 Aug 2012 16:55:54 GMT https://community.splunk.com/t5/Getting-Data-In/Failed-Logons-To-Splunk/m-p/29476#M96669 peasead 2012-08-08T16:55:54Z https://community.splunk.com/t5/Getting-Data-In/Failed-Logons-To-Splunk/m-p/29477#M96670 <P>For 6.2.3 below is the location , seems it is NOT logged under ' index=_audit action=failure'</P> <PRE><CODE>index=_internal sourcetype=splunkd ERROR "Login failed" </CODE></PRE> Mon, 04 Jan 2016 16:08:54 GMT https://community.splunk.com/t5/Getting-Data-In/Failed-Logons-To-Splunk/m-p/29477#M96670 stanwin 2016-01-04T16:08:54Z https://community.splunk.com/t5/Getting-Data-In/Failed-Logons-To-Splunk/m-p/29478#M96671 <P>Thank you, I used this to troubleshoot a user that said he couldn't login</P> Fri, 30 Sep 2016 18:46:43 GMT https://community.splunk.com/t5/Getting-Data-In/Failed-Logons-To-Splunk/m-p/29478#M96671 earlhelms 2016-09-30T18:46:43Z