for the first question: if you have field login or status that take "failed" as value, and user field; here is the query:
index=... status=failed earliest=-30d latest=now|top limit=10 users|table user ...
For the second, if you have region field, here is the query:
index=... | stats avg(user) by region|table user avg(user) ...
Hi If you can provide a sample data it will be very easy to help you.
b. assuming you want to have it directly from splunk:
index = _audit action = failure earliest=-30d | stats values(user) AS Users, values(action) |top limit =10 action
index = _audit action = failure earliest =-30d|top limit=10 action
2.Average number of user check outs by region.
if you have a field in which you keep number of user( may be per month, day, ..........), do something like this:
.........|stats avg(your_field) by region
NOTE: your search depends on you data so please take time to post your sample data next time.