The query looks OK, but its speed also depends on how many events it is processing. Try running the search more often over a smaller time range. Try to reduce "indexes" to the smallest set of indexes that contain relevant Windows events. Consider removing the lookup and hard-coding the relevant event codes. index IN (indexes) sourcetype=xmlwineventlog sAMAccountName IN (_x*, x_*, lx*, hh*) | eval action = case(event_code=x, "login_failure", event_code=y, "lockout") | stats count(eval(action=="login_failure")) as failure_count, count(eval(action=="lockout")) as lockout_count by sAMAccountName | where failure_count >= 3 OR lockout_count > 0 ... View more