A good place to start.
http://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/56b36b4d3c44d86cf33341ca/1454598990744/Windows+Splunk+Logging+Cheat+Sheet+v1.1.pdf
This is the one I use for failed login events.
index=yourindex
sourcetype="WinEventLog:Security"
EventCode=4625
|fillnull value=NULL
| eval Account_Name = mvindex(Account_Name,1)
| eval Security_ID = mvindex(Security_ID,1)
| eval LoginType=case(Logon_Type=3,"RPC (not RDP)",Logon_Type=4,"Batch",Logon_Type=5,"Service",Logon_Type=7,"Screen Unlock/Session Resume",Logon_Type=10,"Remote Desktop",Logon_Type=11,"Cached",Logon_Type=9,"New Credentials")
|stats count(Security_ID) as "Login Events" by Security_ID, Account_Name, LoginType,host,_time |sort + Security_ID
In case you want it, here is successful login events.
index=yourindex
sourcetype="WinEventLog:Security"
EventCode=4624
|fillnull value=NULL
| eval Account_Name = mvindex(Account_Name,1)
| eval Security_ID = mvindex(Security_ID,1)
| eval LoginType=case(Logon_Type=3,"RPC (not RDP)",Logon_Type=4,"Batch",Logon_Type=5,"Service",Logon_Type=7,"Screen Unlock/Session Resume",Logon_Type=10,"Remote Desktop",Logon_Type=11,"Cached",Logon_Type=9,"New Credentials")
|stats count(Security_ID) as "Login Events" by Security_ID, Account_Name, LoginType,host,_time |sort + Security_ID
... View more