How to search failed login attempts on our Mac systems for a specific time range?

[klynn89]

Hey,

I am trying to verify we are getting failed login attempt at a specific time on some of our mac systems in Splunk. What kind of search string do I need to perform such a search?

[rphillips_splk]

you should know the value of the index field and sourcetype field to narrow down your search. If you did not specify either of these in inputs.conf on the forwarder the events will default into the main index (index=main).

a basic search with the "key words" you are after would look like this:

index=x sourcetype=y "failed logins"| stats count by host

index=main "failed logins"| stats count by host

use the time picker in the flash timeline to define the time period to search over.