Splunk> logs not matching Active Directory logs.

[eafitt]

I am currently investigating an issue with one of out users, and I see in Splunk> this user has 500+ login failures. When I look at the logs within AD I see this same user having 17,000+ login failures. I am clueless as to why there is a huge difference between the two numbers. I do not have the AD app installed in Splunk> could this be the reason?

[dart]

The other reason could be different events on each side - I'd use the numeric event ID for comparison.

[eafitt]

The search I'm running is: host="PIWMDPAD01" User_Name="the user" EventCodeDescription="Logon Failure - Unknown user name or bad password"
Yes, I have logs from the same time period, and I'm sure we are collecting logs from all of our DCs but I will have to double check this could very well be the problem. Thanks alot.

[dart]

What search are you running? Do you have logs over the same time period? Do you have the security logs from all of your DCs?