Hi all,
Newbie question here: I'm trying to set up some of the 'InfoSec App for Splunk' Dashboards, and running into difficulties. This is the default Splunk query for showing Failed Logons:
| tstats summariesonly=true allow_old_summaries=true count from datamodel=Authentication.Authentication where
Authentication.app=wineventlog Authentication.action=failure
I think I understand the Authentication.action field, and the data I'm attempting to point Splunk to are Windows logs with an action field equal to 'failure', but I don't understand the Authentication.app field. Is that the srctype that I'm pointing it to, or the index where the logs are? (Our index is named 'wineventlog', and contains security logs that have 'failure' and 'success' for logons.).
Any help is appreciated!
