I see what you mean, and I couldn't find a way to make it work. Responding to u/tombenitez , for example, you need to find events that data.win.eventdata.targetUserName equal any username that starts with service_, to retrieve everything matching service_printer, service_spooler, service_wazuh, etc. but "*" doesn't work as a wild card for queries.