I've been working on a problem that has me stumped. I have a 4624 and 4633 event that I want to correspond with each other. The 4624 is used to identify logons while we are using 4663 (with a particular Object Name) as a way to signify logoffs. The problem is that there isn’t always a 4663 generated due to the user having to access an item. What I’d like to do is Identify a 4663 event and then identify the most recent 4624 to tie them together. The common thing that will be used to tie them together is the Account_Name field. The closet thing I have working is below. sourcetype = * ((Message=** AND Accesses= ReadAttributes) OR (Object_Name=)) | transaction Account_Name maxspan=12h | eval start = _time | eval End = _time + duration | eval StartTime=strftime(Start, "%m/%d/%y %H:%M:%S") | eval EndTime=strftime(End,"%m/%d/%y %H:%M:%S") | eval string_dur =tostring(round(duration), "duration") | eval formatted_dur = replace(string_dur,"(?:(\d+)\+)?0?(\d+):0?(\d+):0?(\d+)","\1d \2h \3m \4s") | eval Duration=replace(formatted_dur, "^d (0h (0m )?)?","") | table Account_Name, StartTime, EndTime, Duration ... View more