How to track users by IP address for failed login attempts?

Path Finder


We need assistance in finding failed login attempts by IP address. This is because we received an alert for a failed login attempt for the "Admin" user.

Is there any way we can track the IP address from which it is accessed?

Thanks in advance.

0 Karma


If this is a Windows environment, you can access failed login events (EventCode=4625) and look into the "Source_Network_Address" field. The IP address the user attempted to login from will be listed there.

index=wineventlog EventCode=4625
0 Karma

Path Finder

Hi, but this is not windows environment.


0 Karma


Hi @splunker9999

Be sure to include all relevant information when you post your question. It's good to know it's not a Windows environment, but to save other users the trouble of assuming everything about your issue, can you please provide more details?

0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...