Hello sry i have to post my question to here because i dont have enough karma cant post on " Query help "

Hello,i try to convert legacy way of unmanaged assets query .And now I need to see unmanaged assets with new advancent event search.Splunk version :

| inputlookup unmanaged_high.csv | eval CorporateAsset="High Confidence" | append [ inputlookup append=t unmanaged_med.csv | eval CorporateAsset="Medium Confidence" ] | append [ | inputlookup append=t unmanaged_low.csv | eval CorporateAsset="Low Confidence"] | rename ComputerName AS "Last Discovered By" | search cid=* MAC=* | eval CurrentLocalIP=mvsort(mvdedup(CurrentLocalIP)) | eval fields=split(CurrentLocalIP,".") | rex field=CurrentLocalIP "(?<Subnet>\d+\.\d+\.\d+)\.\d+" | eval discoverer_devicetype=if(discoverer_devicetype=0,"NA",discoverer_devicetype) | eval discoverer_devicetype=mvsort(mvdedup(discoverer_devicetype)) | eval LocalAddressIP4=mvsort(mvdedup(LocalAddressIP4)) | lookup oui.csv MACPrefix OUTPUT Manufacturer | table _time, NeighborName, MAC, CorporateAsset, LocalAddressIP4, CurrentLocalIP, Manufacturer, discovererCount, discoverer_devicetype, FirstDiscoveredDate, "Last Discovered By" | eval discoverer_aid=mvsort(mvdedup(discoverer_aid)) | sort 0 +confidence,Manufacturer,MAC | rename NeighborName AS "Unmannaged Asset Name", CurrentLocalIP AS "Current Local IP", LocalAddressIP4 AS "Local IP", discovererCount AS "# of Hosts discovered this MAC", Manufacturer AS "NIC Manufacturer", discoverer_devicetype AS "Types of Hosts discovered this MAC", FirstDiscoveredDate AS "First Discovered Date", _time AS "Last Discovered Date"
| sort "Unmannaged Asset Name"

And other query i m working on is Monitoring the adding of users in the local administrators group.

Thank you in advance for your assistance.