Hi Woodcock, Could you explain how it detects the new IP using your command? I can view the results but am not understanding the working part of the command.   Thanks In advance ... View more

you can refer below. thank you <form version="1.1" theme="dark"> <label>Authentication_Log_ Monitoring</label> <fieldset submitButton="false"> <input type="text"> <label>field1</label> </input> </fieldset> <row> <panel> <title>Real_Time_Monitoring</title> <table> <search> <query>source="wineventlog:security" | stats count by Account_Name,TaskCategory</query> <earliest>rt-120s</earliest> <latest>rt</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">cell</option> <drilldown> <set token="Account">$row.&lt;Account_Name&gt;$</set> <set token="Task">$row.&lt;TaskCategory&gt;$</set> </drilldown> </table> </panel> </row> <row> <panel> <event> <search> <query>source="wineventlog:security" Account_Name="$Account$" TaskCategory="$Task$"</query> <earliest>rt-120s</earliest> <latest>rt</latest> </search> <option name="list.drilldown">none</option> <option name="refresh.display">progressbar</option> </event> </panel> </row> </form> . Also, please let me know what the error is in my script. @ITWhisperer ThankYou! ... View more

Hi yuanLiu Thanks for your reply, can you help me to fix the tokens to show the panel for the below search source="wineventlog:security" | stats count by Account_Name,ip_address, _time I need to see the events in the same dashboard by clicking the table. but I tried the same it didn't go through ... View more