Hey! Thanks I think my mistake was with the my regex...  Just a follow up question, with my current results, would I be able to search from my current index and add on other details to correlate? or is there another way around it? Right now,  i would like to add any activity with cmd.exe to correlate or event id specific Thank you so much edit: found out about sub-search, but any advice or tips would be appreicated too ... View more