Bad passwords logged in the DC Netlogon logs:

[Bis]

Bad passwords logged in the DC Netlogon logs:

for a specific account name:  index=cim sourcetype=netlogon host=*dc* "0xC000006A" Logon_Account="*<accountname>”  *** need the asterisk since the netlogon log usually puts the domain netbios name in front of the account name,

for a specific account by source:  index=cim sourcetype=netlogon host=*dc* "0xC000006A" Logon_Account="*<accountname>”   *** same query as above because I did not find an easy way to get the bad password source. 

Anyone please help me