I was "sort" command which has limit for 10000 thanks ... View more

patel, please don't post a comment as an answer. there is a link to 'add comment'. thanks. ... View more

Hi, Not sure if this is related, we did face an issue with one of the Administrator Audit panels under the Active Directory section: Administrator Logons. After troubleshooting, we discovered part of the search was incorrect which leads to inaccurate results return. The default search for the panel is as below: eventtype=msad-successful-user-logons dest_nt_domain="$select242$" user="$select244$"|rename src as src_ip|`ip-to-host`|`fix-localhost`|lookup SiteInfo host|dedup consecutive=t Site,src_nt_host,src_ip|table _time,Site,src_nt_host,src_ip|rename src_nt_host as Workstation,src_ip as "IP Address" Just remove the |rename src as src_ip and the panel should return the proper result. Hope this help! ... View more