Hi I'm trying to find user that login on Non-working hour between 4pm-4am by looking at eventcode=4624.I need to exclude the same user within 1 minute range to reduce number of events so I try to using dedup user, _time but it only delete the user that has same time. Code: index=wineventlog EventCode=4624 category=Logon | eval workHour=strftime(_time, "%H") | where workHour <= 4 OR workHour >= 22 | dedup user _time | table _time user I also get the results but that's too high due to event that has the same user login at the same minute like 22:02:00 userA 22:02:15 userA 22:02:17 userA 22:05:00 userB 22:05:13 userฺB 22:05:18 userA how to make it like 22:02:00 userA 22:05:00 userB 22:05:18 userA I was try to use bin user span=1m but it not work for me Any help guys? ... View more

Hi guys i'm kinda new in Splunk. I try to create dashboard name "alerts" that is the same name as default alert tab  on Search apps and after I click save. default alerts page that I use to check on my alert got replaced into my new dashboard that has the same name. now everytime i click on alerts link i will go to my alerts dashboard not default alerts page that normally come with Search App so I wonder does it has a way to get default alert tab back.  I try to find in on app and setting but not found it yet Thanks ... View more