# Simple Search and confusion
**URL:** https://discuss.elastic.co/t/simple-search-and-confusion/136001
**Category:** Kibana
**Created:** [June 14, 2018, 8:28pm UTC](https://discuss.elastic.co/t/simple-search-and-confusion/136001 "2018-06-14T20:28:37Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Corey\_H](https://discuss.elastic.co/u/Corey_H)
#### Post date: [June 14, 2018, 8:28pm UTC](https://discuss.elastic.co/t/simple-search-and-confusion/136001/1 "2018-06-14T20:28:37Z")
I am currently working on searching for failed "computer accounts" in windows event ID 4776.
Data
2018 Jun 14 16:21:31 WinEvtLog: Security: AUDIT\_FAILURE(4776): Microsoft-Windows-Security-Auditing: (no user): no domain: [somedoman.com](http://somedoman.com): The domain controller attempted to validate the credentials for an account. Authentication Package: MICROSOFT\_AUTHENTICATION\_PACKAGE\_V1\_0 Logon Account: CCOMPUTERNAME$ Source Workstation: CCOMPUTERNAME Error Code: 0xc0000064
Basicly I am just trying to do
data.id:4776 AND full\_log: "Account: CC\*$"
or computers that start with CC.
I just cant seem to get it working.
Thanks for the help in advance.
---
### Author:  [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)
#### Post date: [June 14, 2018, 10:38pm UTC](https://discuss.elastic.co/t/simple-search-and-confusion/136001/2 "2018-06-14T22:38:21Z")
Can you give an example of what the document looks like which your indexing?
---
### Author:  [@Corey\_H](https://discuss.elastic.co/u/Corey_H)
#### Post date: [June 15, 2018, 1:21pm UTC](https://discuss.elastic.co/t/simple-search-and-confusion/136001/3 "2018-06-15T13:21:55Z")
Thanks for the Reply.
The system is configured to receive messages from OSSEC, so all the documents are just windows event logs.
Windows uses a $ sign at the end of the computer name to signify that it is a computer account.
So a normal user would have an account like "CoreyH" and the computer that is joined to the domain would have account like COMPUTER$
I am trying to search for computers that start with CC and end with $ so that I can send the request to the correct team.
SO a single doc is:
2018 Jun 14 16:21:31 WinEvtLog: Security: AUDIT\_FAILURE(4776): Microsoft-Windows-Security-Auditing: (no user): no domain: [somedoman.com](http://somedoman.com): The domain controller attempted to validate the credentials for an account. Authentication Package: MICROSOFT\_AUTHENTICATION\_PACKAGE\_V1\_0 Logon Account: CCOMPUTERNAME$ Source Workstation: CCOMPUTERNAME Error Code: 0xc0000064
That "$" is no supposed to be a special character, but for the life of me, I cant seem to use it in a search.
Thanks for you time.
Corey
---
### Author:  [@Corey\_H](https://discuss.elastic.co/u/Corey_H)
#### Post date: [June 18, 2018, 1:51pm UTC](https://discuss.elastic.co/t/simple-search-and-confusion/136001/4 "2018-06-18T13:51:27Z")
BUMP 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 16, 2018, 1:51pm UTC](https://discuss.elastic.co/t/simple-search-and-confusion/136001/5 "2018-07-16T13:51:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.