Index=wineventlog Eventcode= 4624 user!=*$ user!=system | stats count  updated   ... View more

Thank you removing both $ actually killed my search but $ after the Target_Account_Name!=* and adding OR made it function beautifully! (Original) Target_Account_Name!=*$ Subject_Account_Name!=*$ (Modified)   Target_Account_Name!=* OR Subject_Account_Name!=*$ ... View more