https://community.splunk.com/t5/Monitoring-Splunk/Logging-Login-Data-of-VM/m-p/688164#M10195 <P>But if the VM does not log those Data so far it is not possible?</P> Tue, 21 May 2024 13:08:50 GMT Jan21 2024-05-21T13:08:50Z https://community.splunk.com/t5/Monitoring-Splunk/Logging-Login-Data-of-VM/m-p/688145#M10193 <P>Hello,</P><P>i wanted to ask if there is a way in Splunk to collect failured Login Data from Users on a Virtual Machine that is hosted with VMware, so that i can see if a user tried to login like 5 times and failed the Login on VM 5 times?&nbsp;</P><P>Would be nice to use it for finding out if there is some Kind of Brute Force Attack or something else going on.</P> Tue, 21 May 2024 10:50:47 GMT https://community.splunk.com/t5/Monitoring-Splunk/Logging-Login-Data-of-VM/m-p/688145#M10193 Jan21 2024-05-21T10:50:47Z https://community.splunk.com/t5/Monitoring-Splunk/Logging-Login-Data-of-VM/m-p/688153#M10194 <P>Yes, it is possible.&nbsp; If the VM or identity provider logs failed logins to Splunk then you can search those events for multiple attempts within a given timeframe.</P> Tue, 21 May 2024 12:19:14 GMT https://community.splunk.com/t5/Monitoring-Splunk/Logging-Login-Data-of-VM/m-p/688153#M10194 richgalloway 2024-05-21T12:19:14Z https://community.splunk.com/t5/Monitoring-Splunk/Logging-Login-Data-of-VM/m-p/688164#M10195 <P>But if the VM does not log those Data so far it is not possible?</P> Tue, 21 May 2024 13:08:50 GMT https://community.splunk.com/t5/Monitoring-Splunk/Logging-Login-Data-of-VM/m-p/688164#M10195 Jan21 2024-05-21T13:08:50Z https://community.splunk.com/t5/Monitoring-Splunk/Logging-Login-Data-of-VM/m-p/688166#M10196 <P>Splunk cannot search what it doesn't have.</P> Tue, 21 May 2024 13:15:08 GMT https://community.splunk.com/t5/Monitoring-Splunk/Logging-Login-Data-of-VM/m-p/688166#M10196 richgalloway 2024-05-21T13:15:08Z