Search for usage and login attempts for list of users

[Sathya0Q]

I recently started learning Splunk . Could you help me!!

Have list of users and particular looking for search query to fetch login attempts of those list of user accounts.

[anilchaithu]

@Sathya0Q 

I guess you have the list of users in a lookup file. If not please create one with field name as user.

Use the below search to get the login attempts from the selected users. If the field name in the lookup is not user, you should use a rename command in the subsearch

index=_audit [ | inputlookup users.csv ] login attempt

-- Hope this helps