You need more than a CSV file to monitor the users. Presuming you are logging user login failures in Splunk, you can filter them using the CSV file like this.
index=foo [ | inputlookup mylookup.csv | fields <<user name field>> | rename <<user name field>> AS <<indexed user name field>> ]
---
If this reply helps you, Karma would be appreciated.
