Is the application logging account lockouts to Splunk? If so, you can create an alert when a lockout event is detected. If the application does not log to Splunk then Splunk has no way to know the account has been locked out and cannot alert you.
---
If this reply helps you, Karma would be appreciated.
