Hello, I have been asked to optimize this logic because is taking too long to run. I am not sure how else can I write to make it run faster. It's not throwing any errors it just takes a long time to run. Any help would be highly appreciate. 🙂 Thanks!   index IN (indexes) sourcetype=xmlwineventlog sAMAccountName IN (_x*, x_*, lx*, hh*) | lookup mas_pam_eventcode.csv event_code AS EventCode OUTPUT action | stats count(eval(action=="login_failure")) as failure_count, count(eval(action=="lockout")) as lockout_count by sAMAccountName | where failure_count >= 3 OR lockout_count > 0 ... View more