I see in your original post that you mention searching over the last 7 days but your SPL has hardcoded "earliest=-1h" in it. This will override the timerange input into the time selector. I also have some Windows event logs indexing in my local instance and by default, it looks like it is the source=WinEventLog:Security and sourcetype=WinEventLog So maybe try updating your search to something like this and see if you get expected results. index=<your_index> sourcetype=WinEventLog source="WinEventLog:Security" Account_Name=maxwell EventCode=4740 host IN ("dctr01*", "dctr02*", "dctr03*", "dctr04*") earliest=-7d@d latest=now | table _time Caller_Computer_Name Account_Name EventCode Source_Network_Address Workstation_Name ... View more