The Windows and Active Directory apps (NOTE: Choose relevant app based on your requirement) have a heap of field extractions and eventtypes that will be useful to you for this sort of stuff.
Assuming your logs are already in Splunk, your search would be as simple as:
eventtype=windows_logon_failure
If you don't have the apps installed or dont want to install them you could search for the relevant EventCodes instead. Example below, where "source_of_your_logs" = whatever the source is called in your Splunk installation.
source=source_of_your_logs EventCode=529 OR EventCode=4625
