Hi, I am trying to create a search that finds two sequential events. So far I have: index=wineventlog EventCode=4624 [ search index=wineventlog EventCode=4625 | eval earliest=_time | eval latest=_time+600 | fields earliest latest ComputerName ] This works and returns successful windows logins that follow a failed login within a 10min period. What I want to do though is return a table that shows the time that the first event occurred and the time that the second triggering event occurred. I tried appending: | table ComputerName earliest _time But the earliest field comes back blank when I want that to be showing the time stamp fo the event that matched the subsearch. Any help would be appreciated. Thanks. ... View more

Hi All, Sorry, this might be an obvious one but I'm having trouble finding information on this specific problem. I have a KV store named 'critical-servers' which contains a list of host name. In my data model I want to create a boolean value 'critical' which is assigned a value of True if the host who produced the event exists in the kvstore. I seem to only be able to find examples of extracting values from the KVStore and not seeing if a value exists in the list. Thanks in advance. S. ... View more

Hi, Trying to build a use case which looks at user logins and stores the Count, Earliest and Lastest times on a per user, per server basis. Eventually we want it to alert when a user logs in to a server for the first time. Currently trying to do it through a lookup table that is appended every hour. The lookup table is created with the following: | tstats summariesonly=true max(_time),min(_time), count from datamodel=WindowsEvents where EventID.EventCode=4624 NOT EventID.Logon_GUID="{00000000-0000-0000-0000-000000000000}" by host, EventID.Account_Name | outputlookup server_logins.csv And then the alert is setup with the following query: | inputlookup server_logins.csv | rename min(_time) as ftime | eval days_ago=((now()-ftime)/86400) | fields host, EventID.Account_Name, ftime, days_ago | where days_ago < 1 Can someone please advise me on the best way to append the lookup table with a new count and "latest" (or in this case max(_time)) if the record for the user/server already exists? Ideally I would just like the user table to be appended every hour while storing the data of a years worth of logins. Thanks in advance. S. ... View more