How can I configure a password authentication failure alert?

[alialbarwani]

Hi there, I would like to configure Splunk to send an alert when password entry is incorrect 3 times. How can this be done?
Thanks in advance.

[brian_rampley]

I'm assuming you are wanting alerts when someone enters the wrong password trying to log into Splunk.

You can create the alert using SPL to search the internal Splunk logs. Here's a basic search, which can be added on as needed:

index=_internal component=UiAuth action=login status=failure

If you are wanting an alert for a failed logins on a system other than Splunk, then obviously you will need to collect those logs in Splunk and create a search for them.

Once you have your search, you can follow the directions in the splunk docs for creating an alert:
https://docs.splunk.com/Documentation/Splunk/latest/Alert/Aboutalerts

[adonio]

create a search that capture your condition,
click save as on the top right corner -> pick "alert" -> use the prompts to set up your alert
read here all the way for detailed information
https://docs.splunk.com/Documentation/Splunk/latest/Alert/Aboutalerts
hope it helps