* * -24h@h now Cisco RT Cisco SW Hirsch SW Aviat * *
index="*" source="wineventlog:security" sourcetype="wineventlog:security" $nni$ Client_IP_Address=$ip$ NOT Account_Name=orion* Client_Friendly_Name!="" Client_Friendly_Name=$Client_Friendly_Name$ | rename Account_Name AS utilisateur | table _time,Client_Friendly_Name, Client_IP_Address, utilisateur , Result, Network_Policy_Name