I'm looking for a custom built search string for finding first time account usage for Windows accounts. Any suggestions?
Thank you
Try this
.... | stats earliest(_time) as first latest(_time) as last by Account_Name