What I want to do is summarize a completed transaction of ActivityID's like Windows updates. However, I do not know if the ActivityID is reused again after a reboot and may not be a part of the original transaction or a period of time passes within 24 hours of my reports and the ActivityID is reused again. Disclaimer, I do not know that much about Microsoft Events... so maybe this sounds all wrong?
My mistake Correlation[]ActivityID...
Looks like it is unique internal admin helped me out:
Thank you. Though it might help someone new like me, never know.
My mistake Correlation[]ActivityID...
Looks like it is unique internal admin helped me out:
This is really a Windows question not a Splunk question!