How do I create an alert to give failed logins for Splunk servers?

[kellyjos12]

I am trying to create an alert to record failed logins for the Splunk servers, however not all of them show up in my current alert.   I can get the Search Heads and one of my Heavy Forwarders but my Indexers, Deployment/License server and Cluster Master/Monitoring Console server are not reporting.  Is there something that needs to be added or enabled to these servers?

[gcusello]

Hi @kellyjos12,

at first you have to enable log forwarding from all Splunk servers to Indexes to have all Splunk logs in one accessible point: this is a best practice.

then you have to perform a search like the following:

index=_audit sourcetype = audittrail action="login attempt" info=failed
| stats count BY host

then, if you like, you can add a threshold for an alert.

Ciao.

Giuseppe