# Logging login failure to splunk

**URL:** <https://forum.keycloak.org/t/logging-login-failure-to-splunk/9704>\
**Category:** Getting advice\
**Created:** [June 22, 2021, 9:45am UTC](https://forum.keycloak.org/t/logging-login-failure-to-splunk/9704 "2021-06-22T09:45:02Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eugen](https://avatars.discourse-cdn.com/v4/letter/e/ebca7d/32.png) [@Eugen](https://forum.keycloak.org/u/Eugen)\
**Post date:** [June 22, 2021, 9:45am UTC](https://forum.keycloak.org/t/logging-login-failure-to-splunk/9704/1 "2021-06-22T09:45:02Z")

</div>

Hi,

I’m using keycloak on openshift, logging to splunk.  
Login failures get logged as events to the keycloak admin console (save events activated).

Keycloak logging level is set to WARN.  
But only KC-SERVICES0053 is added as log entry in splunk.  
KC-SERVICES0013 is missing in splunk.

Where is my misconfiguration?