hi team, I'm creating a query that I need to look for if a machine changed the password (Password_last_set) more than once for a period of 30 days. I'm not getting it, can you help me? example: if I put the code below with earliest=-90d it brings me the 3 changes. more if I put | search count > 1 it doesn't gather the information and doesn't bring me the statistics. some help me?   Query: (Dont Work) index="main" source="wineventlog:security" EventCode=4742 user="TRBK8SPRD06$" | stats count earliest(_time) as firstTime latest(_time) as lastTime values(user) by Password_Last_Set, user, signature | convert timeformat="%d/%m/%Y %H:%M:%S" ctime(firstTime) | convert timeformat="%d/%m/%Y %H:%M:%S" ctime(lastTime) | search count > 1 WORK: index="main" source="wineventlog:security" EventCode=4742 user="TRBK8SPRD06$" | stats count earliest(_time) as firstTime latest(_time) as lastTime values(user) by Password_Last_Set, user, signature | convert timeformat="%d/%m/%Y %H:%M:%S" ctime(firstTime) | convert timeformat="%d/%m/%Y %H:%M:%S" ctime(lastTime) thanks in advanced ... View more

hi team, could you help me build when a user manages to block his password 3 times in a 24 hour period generate a trigger? this for each user.. I'm thinking of something like this.   index="main" source="wineventlog:security" EventCode=4740 earliest=-25h | rex field=_raw "(?<Account>Account That Was Locked Out:)" | search NOT Account_Name="Guest" | eval Period=if(_time>relative_time(now(),"-1h"),"New","Old" ) | stats count values(Period) as Period by acct_name | where mvcount(Period)=1 AND Period="New" AND count >= 3 | sort -count | head 10 | fields -Period   but apparently it doesn't work. ... View more