Rule to detect 'windows audit log cleared'

Path Finder

here is the start of my search but having issues figuring out the best way to capture the information i need.

| tstats summariesonly=true values(All_Changes.result) as description from
datamodel=Change_Analysis where index=wineventlog All_Changes.tag=
All_Changes.tag!=stopped by All_Changes.src, All_Changes.result_id, All_Changes.change_type,
All_Changes.action, All_Changes.status | rename All_Changes.* as *

Tags (1)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!