Hi All,
I want to create a use case where the account is inactive for 60 days and it got enable after 60 days..
I tied to draw ta logic but not sure whether query is correct or not.
Can somebody please modify the query if it required some change
index=wineventlog EventCode=4624 user=”*@xyz.com" earliest= -60d latest = now() | transaction user maxspan=60d search (EventCode!=)
Thank you
