Hi guys, I hope I can borrow your fantastic brains on this one, I have the same concept, I want to check the top failed ip that authenticated afterwards:
<search_for_authenticated_users> ip [<search_for_failed_user>| top limit=100 client_ip | rename clientip AS ip | table ip ] | top user ip
I hope someone can shed some light, or direct me somewhere where some else has faced the same problem.
... View more