https://dfarq.homeip.net/the-workstation-events-you-want-to-be-logging-in-splunk/