You already did the sort -Count, so just complete your search with a | head 10 ... View more

Thanks, it worked ... View more

You will need to create a search that generates the results you want in the report, and then create a scheduled report that runs on the time frame you specify. You would need a separate scheduled report for each time frame. Depending on your search output, you can create a variety of charts to visualize the data. "Failed Logins" is a pretty broad term in a Windows environment. You should specify which type of logon failures you're interested in. The four common ones are 4776, 680, 4625, and 529, and there 9 different types of logons. There are also different types of users - system, functional, authenticated... ... View more