All Apps and Add-ons

Fortinet FortiGate App for Splunk: Why are there no login or failed login attempt events in the authentication dashboard?

brandonf
Path Finder

Good day

We are only seeing user logoff events in the Authentication dashboard - there are no logons or failed login attempts etc.
Should these be under type=event?

We currently use Active Directory for authentication.

regards
B

0 Karma

jerryzhao
Contributor

They should be under type=event and subtype=user
can you do a search in research and report app with query string fgt_auth? and see if there is any result about logon

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...