Yah.  And ole Lizzy Li, the principal product manager, indicated in a .conf session that "parity" between Classic and DS was their intent.  So much for parity. ... View more

I can't say when this stopped working, but as of version 8.2.4 index=_audit no longer utilizes action=login*.  Run a "| stats values(action)" and you'll see what I mean. ... View more