ndepth returns no data under usernames when I go to refine fields

Question

I'm trying to use ndepth to see when a windows user logged on/off last week but ndepth returns no data under usernames when I go to refine fields, what am I doing wrong (quite new install)? Thanks

will_burgess · Answer

Thanks for the advice, my product had lost its licence info so re-entered that and started finding nodes!

curtisi · Answer

I tried an nDepth search in my lab, and it worked for me.  I honestly don't like the "RefineFields" options since they're sort of a blunt instrument.  They work, but there's a better way!

If you use, for example, "UserLogon.DestinationAccount=*USERNAME*" I think the results are better/more consistent.

I'd include screenshots, but THWACK is being silly for some reason.