I am trying to create a table that shows the number of distinct users that have logged into a machine. I am having problems getting the domain to appear next to the distinct user count.
Current search& output
index=logs event=logon | dc(username) AS UserCount
UserCount
106
DESIRED Output
Domain UserCount
GUEST 20
INTERNAL 72
EXTERNAL 4
WIRELESS 10
I tried various permutations of stats count by, table, and sum, but I just can't seem to figure it out.
Does index=logs event=logon | stats dc(username) AS UserCount by Domain
not give you what you want?
Does index=logs event=logon | stats dc(username) AS UserCount by Domain
not give you what you want?
Yea... that's exactly what I needed. Can't believe I overlooked something so simple, I was waaaay over-thinking it. Thank you.