Hi,   Basically I need to find out when some old service accounts were last used/if they have ever been used. We have 1000's and would like a report string that would report based on all accounts found in a particular OU. I have one for searching specific accounts but copy and pasting all the account names is very tedious.   This is what I have for searching accounts:   index=wineventlog source="WinEventLog:Security" Account_Name=redbox.service host!=DOMAIN, host!=DOMAIN, host!=DOMAIN, host!=DOMAIN* | stats count by Account_Name, host I am very new to splunk so any suggestions would be much appreciated. If you know of a better way to do this then feel free to let me know!   ... View more