Security

Linux failed login attempts

lohit
Path Finder

Hi all,

What is the search to find out the total failed login attempts in Linux? I donot want to use *nix app for this. I am getting the logs from /var/log/secure.
Please help.

Lohit

Tags (2)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

You will want to look at the Search Language guide. This question is very broad, and with no indication of what your data looks like. You could try source=/var/log/secure login failed and see what happens, but really you should refer to the Search Tutorial and go from there.

http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Startsearching

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...