Splunk Search Cheat Sheet

Planted . Last tended .


# Bad password
index=winsecuritylogs, EventCode=4625, <user-account>

# Correct attempt
index=winsecuritylogs, EventCode=4624, <user-account>

Updated August 25, 2026 at 14:30 . Thoughts? Email me.