Hey thanks for the suggestion. It worked as long as I used single quotes inside the (), but I ended up going a "simpler" way to display the difference between them. index="okta" "outcome.result"=SUCCESS displayMessage="User single sign on to app" | stats dc(actor.alternateId) as "Total Logins" | join [ | search index="okta" "target{}.displayName"="Palo Alto Networks - Prisma Access" "outcome.result"=SUCCESS displayMessage="User single sign on to app" | stats dc(actor.alternateId) as "Users Logging into Prisma"] | table "Users Logging into Prisma", "Total Logins" | eval "Users Not Using Prisma"=('Total Logins' - 'Users Logging into Prisma') | table "Users Logging into Prisma", "Users Not Using Prisma" | transpose As a side question, how are you doing the markup to designate SPL?
... View more