https://community.splunk.com/t5/Monitoring-Splunk/Splunk-success-fail-Logins/m-p/219638#M2198 <P>Thank! It got both Ldap and local accounts</P> Tue, 09 Aug 2016 16:03:51 GMT kiran331 2016-08-09T16:03:51Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-success-fail-Logins/m-p/219635#M2195 <P>Hi</P> <P>How can i get a report of Success and Fail Logins in Splunk Local accounts(not LDAP) for last 30 days?</P> Tue, 09 Aug 2016 15:00:44 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-success-fail-Logins/m-p/219635#M2195 kiran331 2016-08-09T15:00:44Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-success-fail-Logins/m-p/219636#M2196 <PRE><CODE>index=_audit tag=authentication | stats count by user, info | sort - info </CODE></PRE> <P>this works fine, but it includes LDAP as well. let me check how to get only local accounts.<BR /> one more question - do you have both Local accounts and LDAP authentication together ah?!?!</P> Tue, 09 Aug 2016 15:52:46 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-success-fail-Logins/m-p/219636#M2196 inventsekar 2016-08-09T15:52:46Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-success-fail-Logins/m-p/219637#M2197 <P>looks like source and sourcetype are audittrail. i hope this is same for LDAP and local users as well. please check it and update us(for those who uses LDAP only)<BR /> index=_audit source = audittrail sourcetype = audittrail</P> Tue, 09 Aug 2016 16:01:30 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-success-fail-Logins/m-p/219637#M2197 inventsekar 2016-08-09T16:01:30Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-success-fail-Logins/m-p/219638#M2198 <P>Thank! It got both Ldap and local accounts</P> Tue, 09 Aug 2016 16:03:51 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-success-fail-Logins/m-p/219638#M2198 kiran331 2016-08-09T16:03:51Z