I figured it out. For some reason the data model changes the signature to "User logon with misspelled or bad user account", so my searches were working but I was using terms that were not in the string. Once I changed that, I was able to find the results I was looking for. ... View more

Thank you! I just had to add some brackets, but that gave me exactly the results I was looking for. index="wineventlog" (EventCode=4624 OR (EventCode=4768 Result_Code=0x6)) [ search index="wineventlog" EventCode=4768 Result_Code=0x6 | table src_ip] | stats count, distinct_count(Account_Name), values(Account_Name) by src_ip   ... View more