https://community.splunk.com/t5/Splunk-Search/Top-10-same-failed-login-on-different-computer/m-p/116468#M30938 <P>The specifics depend on your data, but this is the general idea:</P> <PRE><CODE>&lt;search for failed logins&gt; | stats count as Failures by username | top Failures | ... </CODE></PRE> Thu, 26 Mar 2015 20:21:42 GMT richgalloway 2015-03-26T20:21:42Z https://community.splunk.com/t5/Splunk-Search/Top-10-same-failed-login-on-different-computer/m-p/116465#M30935 Thu, 26 Mar 2015 18:24:41 GMT https://community.splunk.com/t5/Splunk-Search/Top-10-same-failed-login-on-different-computer/m-p/116465#M30935 arkonner 2015-03-26T18:24:41Z https://community.splunk.com/t5/Splunk-Search/Top-10-same-failed-login-on-different-computer/m-p/116466#M30936 <P>Do you have a question?</P> Thu, 26 Mar 2015 18:52:51 GMT https://community.splunk.com/t5/Splunk-Search/Top-10-same-failed-login-on-different-computer/m-p/116466#M30936 richgalloway 2015-03-26T18:52:51Z https://community.splunk.com/t5/Splunk-Search/Top-10-same-failed-login-on-different-computer/m-p/116467#M30937 <P>The title is the question, how to do a search like this</P> Thu, 26 Mar 2015 20:01:30 GMT https://community.splunk.com/t5/Splunk-Search/Top-10-same-failed-login-on-different-computer/m-p/116467#M30937 arkonner 2015-03-26T20:01:30Z https://community.splunk.com/t5/Splunk-Search/Top-10-same-failed-login-on-different-computer/m-p/116468#M30938 <P>The specifics depend on your data, but this is the general idea:</P> <PRE><CODE>&lt;search for failed logins&gt; | stats count as Failures by username | top Failures | ... </CODE></PRE> Thu, 26 Mar 2015 20:21:42 GMT https://community.splunk.com/t5/Splunk-Search/Top-10-same-failed-login-on-different-computer/m-p/116468#M30938 richgalloway 2015-03-26T20:21:42Z