index=* success="false" process_name="C:\\Windows\\System32\\svchost.exe" | stats count as failedAttempts by user | sort -failedAttempts index=* success="false" process_name="C:\\Windows\\System32\\svchost.exe" | timechart count by user | sort by _time I tried do both query but I'm stuck...Need any guidance, thank you 🙂 ... View more