When building the filter using [userlogon.detectiontime (does not contain) business hours time-of-day-set], the engine ignores it. When doing the filter in ndepth, the line gets flagged red as "invalid search". I don't understand why it is not working. And in lieu of that, is there another way of building the filter to view logon attempts outside of business hours?
↧