Hy, i have problem with creating table for failed authentication. This is my search.. index=windows_ad source="wineventlog:security" earliest=-24h@h latest=now ("EventCode=675" OR ("EventCode=672" AND Type="Failure Audit")) OR (EventCode=4771 AND "Audit Failure") NOT (User_Name="*$" OR Account_Name="*$") NOT Failure_Code=0x19 | eval "User Account"=coalesce(User_Name,Account_Name) | stats count by "User Account" | where count > 100 | table "User Account" "Client IP" "Client Port" "Failure Code" count | sort - count Field User Account and count gives me entry in table but fields Client Ip, Client port and Failure code does not. I tried few times with eval command for those three fields but its all the same. Can you please help me with that, here is some of fields that can be used for this table. Thank you. ... View more

Hi, i'm trying to set an alert that will notify me through mail with the name of accounts which have failed authentications more than some number. The result of search must be only for active day, not for 24 hour period. I think that the search is all right but i have problem with scheduling mail alert. Search looks like this... index=windows_ad source="wineventlog:security" earliest=@d latest=now ("EventCode=675" OR ("EventCode=672" AND Type="Failure Audit")) OR (EventCode=4771 AND "Audit Failure") NOT (User_Name="*$" OR Account_Name="*$") NOT Failure_Code=0x19 | eval "User Account"=coalesce(User_Name,Account_Name) | stats count by "User Account" | where count > 100 | sort - count Can you please help me with scheduling mail step by step? I tried with real-time triggering, schedule triggering, throttle but i didn't receive any mail. Thank you! ... View more