Hi all One of my user lets say maxwell is getting locked frequently. i want to check logs for last 7 days. i am using the below query but i am not getting any output. i have 4 domain controllers(dctr01,dctr02,dctr03,dctr04). index=winevenlog sourcetype=wineventlog:security Account_Name=maxwell EventCode=4740 earliest=-h (host="dctr01*" OR host="dctr02*" OR host="dctr03*" OR host="dctr04*") | table _time Caller_Computer_Name Account_Name EventCode Source_Network_Address Workstation_Name ... View more