Lookups are really powerful and allow you to simplify the way you look at things. They will allow you to define what your status code 0xC00006D means and what the substatus 0xC00006A means. That way you won't have to worry about the code anymore 🙂
If you don't want to build the lookups yourself you can leverage some of the TAs available on splunkbase which in a lot of cases contain predefined lookups with definitions of event codes.
000006A user name is correct but the password is wrong
The best way to understand how things work is to install Splunk_TA_Windows in your Search Head and CIM addon. This will greatly enrich your data and puts tag for each of these. For example, the above status/sub-status will be enriched to have tags of "authentication, failure, error, windows" etc. This way your data becomes device agnostic