Hey everyone, I'm trying to write a search that will show the login events that occurred after the last successful logon event. So far I have this: index="[index name]" sourcetype=WinEventLog "eventcode=4625" earliest=lastLogon | eval lastLogon= where lastLogin = the time value of the last event from this search: index="[index name]" sourcetype=WinEventLog "eventcode=4624" Failed Logons: index="[index name]" sourcetype=WinEventLog "EventCode=4625" Successful Logons: index="[index name]" sourcetype=WinEventLog "EventCode=4624" Does anyone have an idea of how to evaluate this? ... View more