How can I configure a password authentication failure alert?

New Member

Hi there, I would like to configure Splunk to send an alert when password entry is incorrect 3 times. How can this be done?
Thanks in advance.

0 Karma

Path Finder

I'm assuming you are wanting alerts when someone enters the wrong password trying to log into Splunk.

You can create the alert using SPL to search the internal Splunk logs. Here's a basic search, which can be added on as needed:

index=_internal component=UiAuth action=login status=failure

If you are wanting an alert for a failed logins on a system other than Splunk, then obviously you will need to collect those logs in Splunk and create a search for them.

Once you have your search, you can follow the directions in the splunk docs for creating an alert:

0 Karma


create a search that capture your condition,
click save as on the top right corner -> pick "alert" -> use the prompts to set up your alert
read here all the way for detailed information
hope it helps

0 Karma