> index=AD host=YOURSTSBOX > EventCode=500 OR EventCode=501 OR > EventCode=299 | rex "Instance > id:\s+(?<instance>\S+)" | > transaction instance maxspan=5s | rex > "Relying party:\s+(?<rely>\S+)" | rex > "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname\s+(?<nt_account>\S+)" > | stats dc(nt_account) as count by > rely|sort -count ... View more