That did it! Thank you so much, Rich. This will help me greatly. The corrected SPL is below so that others in the community can utilize it if needed now that the time is populating as intended. source="WinEventLog:Security" (EventCode=4740 OR EventCode=644 OR EventCode=4625 OR EventCode=4771) user=* | eval src_nt_host=coalesce(src_nt_host,host) | eval lockout=if(EventCode==644 OR EventCode==4740,"Yes","No") | eval time = if(lockout="Yes", _time, null()) | stats latest(_time) as time, latest(src_nt_host) as host, latest(lockout) as lockedout values(dest_nt_domain) as dest_nt_domain count(eval(EventCode=4625 OR EventCode=4771)) as count values(Source_Network_Address) as Source_Network_Address by user | eval time=strftime(time,"%c") | rename user to "User Name", Source_Network_Address to "IP Address", count to "Number of Failures" | table dest_nt_domain "User Name" host lockedout time "IP Address" "Number of Failures" ... View more

As @gcusello says you may not have this enabled, specifically the policy you need to enable is: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration> Audit Policies/DS Access > Audit Directory Service Changes One limitation is that it will tell you "Who" changed it, but not "What" was changed. Following that you should see events for 5136 ... View more

index="index" Account_Name="account" EventCode="event code" | stats count last(_time) as _time by Account_Name host EventCode | eval timestamp=strftime(_time, "%B %d, %H:%M:%S %p") | table timestamp Account_Name host EventCode Hi, @rcastello Is this result what you want to know? ... View more

Hi @rcastello, The answer is in the logs... what kind of logs are you collecting already and what applications logs are you fetching from your endpoint ? You need to have a tool on your hosts to detect the applications that are being installed/used/removed then you can fetch the logs from there. Cheers, David ... View more

You could try using the transaction command with startswith and endswith params. Each transactional event will have a new field called duration. You could then do a stats command summing the duration by Account_Name to get the total for the day. People may log in and out many times during the day. I haven't tested this, but hoping it leads you in the right direction. index= source="WinEventLog:Security" EventCode=4624 OR EventCode=4634 Account_Name="" | transaction Account_Name startswith=eval(EventCode=4624) endswith=eval(EventCode=4634) | stats sum(duration) by Account_Name ... View more

It does seem that coalesce takes only two parameters... Sorry, the documentation says -- This function takes an arbitrary number of arguments and returns the first value that is not NULL. ... View more