Tracing failed login attempts in Oracle
You are on the right way.
Column RETURNCODE in DBA_AUDIT_TRAIL or RETURN_CODE in UNIFIED_AUDIT_TRAIL view.

http://docs.oracle.com/database/121/REFRN/GUID-A9993FAC-12D3-4725-A37D-938CC32D74CC.htm#REFRN23023


  This view is populated only in an Oracle Database where unified
  auditing is not enabled. When unified auditing is enabled in Oracle
  Database, the audit records are populated in the new audit trail and
  can be viewed from UNIFIED_AUDIT_TRAIL.


Oracle documentation is always a very good source of information.