Need Splunk Query Help - Consultant needed

[GeraldSteve12]

Having trouble with a Splunk search that's supposed to find failed login attempts from our security logs. The search runs without errors but only returns a fraction of the events I know are there.

I can see the failed login events when browsing raw logs, but my search query isn't catching them all. Tried different time ranges and field filters but still missing data. Need someone who knows Splunk search syntax to help fix this.

Need about 2 hours of help to get the search working properly. Have to have this security report ready by Wednesday for our compliance review."

[livehybrid]

Hi @GeraldSteve12 

Please can you provide the SPL you are using and also give us info (and ideally a sample event) of the data you are searching (eg is this Linux, AWS, azure AD, windows event logs).

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

[ITWhisperer]

What is your current approach?

What is different about the events you are missing?