I need to check which user accounts have had multiple login failures followed by a successful login
quick search in this portal will bring you many results: https://answers.splunk.com/answers/368521/how-can-i-detect-a-successful-login-after-multiple.html https://answers.splunk.com/answers/556974/successful-bruteforce-login.html https://answers.splunk.com/answers/553596/detect-successful-bruteforce-attacksuccessful-logi.html https://answers.splunk.com/answers/336871/how-to-search-for-5-failed-logins-followed-by-1-su.html
there are many more.
