Hi all, Wondering if it is possible to do 10 minute search from when you see an event instead of doing 10 minute windows such as "| bin _time span=10m as window" as this just looks at minutes from the hour?  ... View more

I am trying to create a search which looks for an EventCode 4624 followed by another EventCode 4625 from same user, if someone could assist that would be fantastic. Having a read into Multisearch, join etc. Attempted transaction but appears to be slow index=dirsvcs_seceventlogs source="wineventlog:security" EventCode=4625 [ search source="wineventlog:security" EventCode=4624 | table cs_username EventCode] | stats count, distinct_count(cs_username), values(cs_username) by EventCode ... View more