More than 10 accounts disabled within five minutes.

[weetabixsplunk]

Hi guys,

I'm working on a search that shows more that 10 accounts disabled within a five minute time frame. I feel like the dumbest girl on earth. I know my search works for the most part as the events tab shows the exact amount of events that occurred within that period of time, however, the statistics tab does not display a table:

index=wineventlog EventCode=4725
| bin span=5m _time
| stats count(user), values(user) by _time EventCode
| where count > 10

I also tried
index=wineventlog EventCode=4725
| bin span=5m _time
| table user, Time 
| search count > 10

Any help would be much appreciated.

Thanks

[ITWhisperer]

index=wineventlog EventCode=4725
| bin span=5m _time
| stats count, values(user) by _time EventCode
| where count > 10