I don't think tstats is the way to go since you're analyzing data in aggregate. You might want to look at the answer Woodcock posted earlier: https://answers.splunk.com/answers/368521/how-can-i-detect-a-successful-login-after-multiple.html
You could approximate it with tstats, but I don't believe you can account for consecutive events using tstats with something like:
| tstats `summariesonly` count as failure_count from datamodel=Authentication where Authentication.action=failure earliest=-4h@h latest=-5m@m by Authentication.user, Authentication.app, _time
| join type=left Authentication.user, Authentication.app, _time [| tstats `summariesonly` count as success_count from datamodel=Authentication where Authentication.action=success earliest=-4h@h latest=-5m@m by Authentication.user, Authentication.app, _time]
| where failure_count>3 and success_count>1
.. but this won't account for the sequence of events, it will only find where they occur together, and any sequence spanning one of the time periods won't properly be accounted for.
... View more