https://community.splunk.com/t5/Knowledge-Management/Rule-to-detect-windows-audit-log-cleared/m-p/333894#M5360 <P>here is the start of my search but having issues figuring out the best way to capture the information i need.</P> <P>| tstats summariesonly=true values(All_Changes.result) as description from <BR /> datamodel=Change_Analysis where index=wineventlog All_Changes.tag=<BR /> audit <BR /> All_Changes.tag!=stopped by All_Changes.src, All_Changes.result_id, All_Changes.change_type, <BR /> All_Changes.action, All_Changes.status | rename All_Changes.* as *</P> Tue, 29 Sep 2020 19:01:31 GMT Ghanayem1974 2020-09-29T19:01:31Z https://community.splunk.com/t5/Knowledge-Management/Rule-to-detect-windows-audit-log-cleared/m-p/333894#M5360 <P>here is the start of my search but having issues figuring out the best way to capture the information i need.</P> <P>| tstats summariesonly=true values(All_Changes.result) as description from <BR /> datamodel=Change_Analysis where index=wineventlog All_Changes.tag=<BR /> audit <BR /> All_Changes.tag!=stopped by All_Changes.src, All_Changes.result_id, All_Changes.change_type, <BR /> All_Changes.action, All_Changes.status | rename All_Changes.* as *</P> Tue, 29 Sep 2020 19:01:31 GMT https://community.splunk.com/t5/Knowledge-Management/Rule-to-detect-windows-audit-log-cleared/m-p/333894#M5360 Ghanayem1974 2020-09-29T19:01:31Z