How to get all logs for a specific user in sentinel

[kishore_soc]

Hi Community,

Help me out how to get all the logs for an user in sentinel. I was using the below quire but it is not written the expected results

UserAccessAnalytics
| where SourceEntityName ==  user email address.

Thanks,

Kishore

[#2]

Hi @kishore_soc,

Try this command, 

search "user email address"

This will give you all the logs for a specific user from all tables. 

[#3]

@deshantshukla 

search "name"
| summarize count() by Type
// type will list the tables that are matched, in my example this finds name in the table "LAQueryLogs", so now use that, in the next query

LAQueryLogs
| where AADEmail == "name"

// or just get the last record in each Table
search "name"  
| summarize arg_max(TimeGenerated,*) by Type

[#4]

It worked pretty well