Having trouble with a Splunk search that's supposed to find failed login attempts from our security logs. The search runs without errors but only returns a fraction of the events I know are there. I can see the failed login events when browsing raw logs, but my search query isn't catching them all. Tried different time ranges and field filters but still missing data. Need someone who knows Splunk search syntax to help fix this. Need about 2 hours of help to get the search working properly. Have to have this security report ready by Wednesday for our compliance review." ... View more