Hi all,
I am looking for a solution to show for every day of a week the time of the first activity of a user and the time of its last activity (and the time span between them).
I wanted to use transactions, but from what I understood, I need to know the exact event name to use it... but without transaction it does not seem to work:
source="WinEventLog:Security" | eval User = if(isnull(Account_Name), User_Name, mvindex(Account_Name,1)) | stats earliest(_time) as start, latest(_time) as stop by User
any advice or help would be very appreciated,
Steven
... View more