Hi @uskwarrior1,
I can think that you already ingested WinEventLog:Security from your Domain Controller.
If this is true, you have run a search like this:
index=wineventlog EventCode=4624 host=your_domain_controller
| dedup user
| sort user
| table user
(check if in your Domain Controller there's the field "user" or "Account_name").
Then save this search as a Report or as dashboard's panel.
Ciao.
Giuseppe
... View more
