Hi, I would like to translate my windows event log custom query to splunk search syntax. <QueryList> <Query Id="0" Path="Security"> <Select Path="Security"> *[EventData[Data[@Name='TargetUserName'] = 'ztm31029']] and *[System[(EventID='4624')]] </Select> <Select Path="Security"> *[EventData[Data[@Name='IpAddress'] = '10.228.36.66']] and *[System[(EventID='4624')]] </Select> </Query> </QueryList> The three important fields to searh are IpAddress, EventID and TargetUserName under security events. Thanks! ... View more