Use the following search to create a stacked barchart of AD Password change attempts: source=”WinEventLog:Security” “EventCode=4723″ src_user!=”*$” src_user!=”_svc_*” | eval daynumber=strftime(_time,”%Y-%m-%d”) | chart count by daynumber, status | eval daynumber = mvindex(split(daynumber,”-“),2)
