The specifics depend on your data, but this is the general idea:
<search for failed logins> | stats count as Failures by username | top Failures | ...
Do you have a question?
The title is the question, how to do a search like this
