https://community.splunk.com/t5/Monitoring-Splunk/How-to-monitor-Windows-failed-log-on/m-p/49481#M6997 <P>How to check Windows failed log on using Splunk. </P> Mon, 04 Mar 2013 06:50:56 GMT catch_mili 2013-03-04T06:50:56Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-monitor-Windows-failed-log-on/m-p/49481#M6997 <P>How to check Windows failed log on using Splunk. </P> Mon, 04 Mar 2013 06:50:56 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-monitor-Windows-failed-log-on/m-p/49481#M6997 catch_mili 2013-03-04T06:50:56Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-monitor-Windows-failed-log-on/m-p/49482#M6998 <P>The Windows and Active Directory apps (NOTE: Choose relevant app based on your requirement) have a heap of field extractions and eventtypes that will be useful to you for this sort of stuff.</P> <P>Assuming your logs are already in Splunk, your search would be as simple as: </P> <P>eventtype=windows_logon_failure</P> <P>If you don't have the apps installed or dont want to install them you could search for the relevant EventCodes instead. Example below, where "source_of_your_logs" = whatever the source is called in your Splunk installation.</P> <P>source=source_of_your_logs EventCode=529 OR EventCode=4625</P> Mon, 04 Mar 2013 07:22:33 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-monitor-Windows-failed-log-on/m-p/49482#M6998 mbenwell 2013-03-04T07:22:33Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-monitor-Windows-failed-log-on/m-p/49483#M6999 <P>Further, I would like to monitor files &amp; folders created under C:\ &amp; D:\ drive. </P> <P>How can I do that.</P> Tue, 05 Mar 2013 09:32:28 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-monitor-Windows-failed-log-on/m-p/49483#M6999 catch_mili 2013-03-05T09:32:28Z