topic SPlunk Query-Logins and failure in Splunk Search https://community.splunk.com/t5/Splunk-Search/SPlunk-Query-Logins-and-failure/m-p/234837#M188510 <P>Hi, Can someone please suggest us a query we can build to find successful login and failed attempts in a separate query?</P> <P>Thanks</P> Mon, 07 Mar 2016 14:35:04 GMT splunker9999 2016-03-07T14:35:04Z SPlunk Query-Logins and failure https://community.splunk.com/t5/Splunk-Search/SPlunk-Query-Logins-and-failure/m-p/234837#M188510 <P>Hi, Can someone please suggest us a query we can build to find successful login and failed attempts in a separate query?</P> <P>Thanks</P> Mon, 07 Mar 2016 14:35:04 GMT https://community.splunk.com/t5/Splunk-Search/SPlunk-Query-Logins-and-failure/m-p/234837#M188510 splunker9999 2016-03-07T14:35:04Z Re: SPlunk Query-Logins and failure https://community.splunk.com/t5/Splunk-Search/SPlunk-Query-Logins-and-failure/m-p/234838#M188511 <P>Hi,</P> <PRE><CODE>index=_audit action="login attempt" info=succeeded | table _time user index=_audit action="login attempt" info=failed | table _time user </CODE></PRE> Mon, 07 Mar 2016 14:44:37 GMT https://community.splunk.com/t5/Splunk-Search/SPlunk-Query-Logins-and-failure/m-p/234838#M188511 JMichaelis 2016-03-07T14:44:37Z Re: SPlunk Query-Logins and failure https://community.splunk.com/t5/Splunk-Search/SPlunk-Query-Logins-and-failure/m-p/234839#M188512 <P>I guess this gives us information about our saved searches and how they are running.</P> <P>We are looking to find failed login attempts to splunk hosts?</P> <P>Thanks</P> Mon, 07 Mar 2016 14:55:42 GMT https://community.splunk.com/t5/Splunk-Search/SPlunk-Query-Logins-and-failure/m-p/234839#M188512 splunker9999 2016-03-07T14:55:42Z Re: SPlunk Query-Logins and failure https://community.splunk.com/t5/Splunk-Search/SPlunk-Query-Logins-and-failure/m-p/234840#M188513 <P>I'm not quite sure what you mean but I get login attempts with user name. Why should the action="login attempt" prompt saved searches information? If you want to see the hosts as well expand with</P> <PRE><CODE>index=_audit action="login attempt" info=failed | table _time user host </CODE></PRE> Mon, 07 Mar 2016 15:02:52 GMT https://community.splunk.com/t5/Splunk-Search/SPlunk-Query-Logins-and-failure/m-p/234840#M188513 JMichaelis 2016-03-07T15:02:52Z Re: SPlunk Query-Logins and failure https://community.splunk.com/t5/Splunk-Search/SPlunk-Query-Logins-and-failure/m-p/234841#M188514 <P>this works for us.</P> Mon, 07 Mar 2016 15:14:07 GMT https://community.splunk.com/t5/Splunk-Search/SPlunk-Query-Logins-and-failure/m-p/234841#M188514 splunker9999 2016-03-07T15:14:07Z Re: SPlunk Query-Logins and failure https://community.splunk.com/t5/Splunk-Search/SPlunk-Query-Logins-and-failure/m-p/234842#M188515 <P>Hi there splunker, try like this.</P> <PRE><CODE>index=_audit tag=authentication info=succeeded | stats count by user, info, host | sort - info index=_audit tag=authentication info=failed | stats count by user, info, host | sort - info </CODE></PRE> <P>Dont know about your Splunk environment, but if you are looking to get this from all your instances, you have to forward _audit index to your Search Head.</P> <P>Hope it helps.</P> Mon, 07 Mar 2016 15:15:28 GMT https://community.splunk.com/t5/Splunk-Search/SPlunk-Query-Logins-and-failure/m-p/234842#M188515 alemarzu 2016-03-07T15:15:28Z