Is there a Splunk account lockout for users if you enter your password multiple times?

[inventsekar]

Hi
As all my splunk projects are using LDAP for login, this issue never occurred to me.
1. if we configure splunk's local authentication system and create users, and when the users type wrong password for multiple times, will their account get locked out?
2. For all kinds of users (normal, power, admin) users as well?
3. with any login systems(splunk's own authentication/LDAP/etc), does splunk records the users login/logouts/lockouts, password failures?

EDIT:
This task applies to Splunk Enterprise native authentication and does not apply to SAML or LDAP passwords.
In Splunk Web, click Settings > Access Controls > Password Policy Management.

[renjith_nair · Accepted solution]

@inventsekar ,

From 7.1.0 ,
1. you can configure the lock out period and number of failed attempts. Refer List of password policy configurations
2. For the "admin" privileged users, it doesn't seem to lock the account
3. For the authentication failures, it should be recorded in "_audit" logs for e.g. action="login attempt"

[jhomerlopez]

Even admin and other privileged users can have a lock out policy. There is a capability inside roles management named "never_lockout". You just have to removed it under the "admin" default role.

[inventsekar]

we are on Splunk 7x, but still no results for ...
index="_audit" action=*login*

[renjith_nair]

One of the envs which is running on 6.6.2 with LDAP authentication has the following entry which confirms the logging of external authentication system.

Audit:[timestamp=09-13-2018 06:17:23.690, user=xxxxxx, action=login attempt, info=succeeded, src=0.0.0.0][n/a]

Which auth mechanism are you using?

[inventsekar]

we are using some scripted authentication...
After doing some tweekings, i am able to find the info required..

eventtype=splunk_access
index=_* info=succeeded
index=_audit info=succeeded
index=_audit eventtype=splunk_access

will do some more searching and once i am clear of all doubts, i will accept this as answer..