Hi, I'm new to Splunk & just getting used to it. I'm trying to search for Windows event logs relative to the "TargetUserName" field in the logs. I'm trying to run a search that shows me user accounts that have had two different event logs associated with it in a 7 day period.   The search i'm looking to run is: if a user has had event code 4724 generated and then has event code 4740 occur within 7 days after code 4724 was seen. I was thinking i'd have to define the user name as variable that bring back the results if the event code conditions match (as described above.   Or could there be a better way of going about this?   Any help is appreciated. Thanks. ... View more