County Windows failed-logon volume is huge, and the Authentication data model is healthy and accelerated. What is the efficient default for counting EventCode 4625-style failures?
Select an answer to reveal the explanation.
Short Explanation
When the Authentication model is warmed up, tstats is the express lane for failed-logon counts. Raw EventCode=4625 still works, but it walks the whole county Windows index instead of reading the summary.
Full Explanation
tstats reads tsidx summaries from accelerated data models and is the efficient default when Authentication is healthy. Counting 4625-style failures from the model avoids a raw index=windows scan and is far cheaper than index=* plus rex or a transaction of every Windows event. Raw searches remain a fallback when the sourcetype is not in the model, which is not the case in this scenario.