Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to search failed login attempts of a user ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Need to develop a dashboard and a report for getting the the user information of who tried to log in and failed. Need to get an alert after the 3rd unsuccessful login attempt.
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The following search will give you a list of user names (CN) that have more than 2 failed logins.
sourcetype=yoursourcetype AuthReject
| stats count by CN
| where CN > 2
If you save this search as an alert, you can set the trigger condition to "number of results greater than zero".
You will need to identify the time range though: "number of failed login attempts in the last hour" is a very different thing than "number of failed login attempts in the past week."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The following search will give you a list of user names (CN) that have more than 2 failed logins.
sourcetype=yoursourcetype AuthReject
| stats count by CN
| where CN > 2
If you save this search as an alert, you can set the trigger condition to "number of results greater than zero".
You will need to identify the time range though: "number of failed login attempts in the last hour" is a very different thing than "number of failed login attempts in the past week."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Instead of hoping that someone in the community knows Siteminder, you could post a small portion of the log (with things like user names obfuscated). This would let many members answer your question...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Also it would be helpful to know what you used as a sourcetype, and the necessary field names.
Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps
What’s New in Splunk Observability – September 2025
Fun with Regular Expression - multiples of nine
