How to search for failed login then success with sourcetype="o365:management:activity"?

[Nickbshaw]

Currently using a manual verification of non US logins:

sourcetype="o365:management:activity"
| iplocation ActorIpAddress
| search Country!="United States"  action=success
| stats count by UserId, Operation, ActorIpAddress, Country, action
| sort -count 

I am wanting to create a search that will show failed logins followed by a success for a user regardless of source ip.

Thanks.

[richgalloway]

There's an example of that (and much more) in the Splunk Security Essentials app.  Look for "Basic Brute Force Detection".