How do you edit a correlation rule in a datamodel in Splunk Enterprise Security?

Hello, Our correlation search for "account deleted" in Splunk is firing for any type of machine deletion detected on our domain controllers. Here is our correlation search: | from datamodel:"Change_Analysis"."Account_Management" | where 'tag'="delete" | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(result) as "signature",values(src) as "src",values(dest) as "dest",count by "src_user","user" | where 'count'>0 This rule fires for machine deletions such as when our system engineers remove machines after testing. We don't want to see this activity in incident review. We only want to know when someone has removed a user account. Doing some digging, I can see that there are specific event codes for different types of deletions in wineventlog. For a user account deletion, the eventcode is 4726, but when a machine account is deleted, the eventcode is 4743. So, I made a copy of our correlation rule and added the 4726 event code into the rule like so: | from datamodel:"Change_Analysis"."Account_Management" | where EventCode=4726 | where 'tag'="delete" | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(result) as "signature",values(src) as "src",values(dest) as "dest",count by "src_user","user" | where 'count'>0 This is not working. I tested this search this morning after seeing a user account getting removed. And when I run this version of the search, I get no results. Am I putting the 'where EventCode=4726' portion in the wrong part of the search string? Will this not work within a data model search? Thank You, Tyler Dygert