Hello, I am trying to write a query that will display failed logins (Account_Name, Host, Count). First Query index=wineventlog EventCode=4625 | top limit=20 Account_Name host  | where count > 9 Con 1. Displays "-" in some of the Account_Name fields  Pro 1. Displays all the count and host fields correctly. Second Query index=wineventlog EventCode=4625  | rex "(?ms)Account For Which Logon Failed.+?Account Name:\s+(?<Account_Name>\V+)" |top limit=30 Account_Name host| where count >=9 Con Displays all the Account_Name, count and host fields correctly but displays a lot less results on the table compared to the first query.   Pro Displays all the Account_Name, count and host fields correctly   I need a query that will displays all the Account_Name, count and host fields correctly as well as displays the same amount of results in the first query. Any help is appreciated. Thanks in advance.    ... View more