If you are dig into the datamodel itself of 'Authentication' you will see two a subset of Authentication datamodels. In those you should see "Successful Authentication," Unsuccessful Authentication," etc. The subset names may not be exactly that but you should see those once you open up the 'Authentication' datamodel and poke around.
Once you find those names, the search would be something along the lines below:
|datamodel Authentication Successful Authentication search...
Also, with your search, I would try to map back indexes to specific datamodels to improve overall performance. You can do this with the Splunk Common Informaton Model (CIM) Addon: https://splunkbase.splunk.com/app/1621/
... View more