Hi,
I come to you because I have an error when I execute folloing query. Could any one help me please ?
Here is my quary :
(MsWinEventLog OR norm_id=WinServer*) label=Object label=Access (access_list=\"*4417*\" OR access=\"*WriteData*\") {{user},}, {{fileshare},}, {{path},}, -relative_target in SYSTEM_PATHS | rename relative_target as Object, share_path as Path | chart count() by user, device_name, object_type,Path, Object | fields user, device_name, object_type, Path, Object
and when I execute this query I receive these error message :
![](https://uploads-eu-west-1.insided.com/logpoint-en/attachment/d3524a4d-e7ec-4753-824e-c1158da0246f.png)
![](https://uploads-eu-west-1.insided.com/logpoint-en/attachment/a339408b-bcfe-4cd6-90d9-f88f38f1e35a.png)
Thanks in advance
Looking forward to reading you