I believe this is what you are looking for.
sourcetype=WinEventLog:Security EventCode=4624 | eval Logon_Account_Name = mvindex(Account_Name,1) | eval Logon_Account_Name=upper(Logon_Account_Name) | eval Sec_ID = mvindex(Security_ID,1) | eval temp=split(Sec_ID,"\\") | eval Sec_ID=mvindex(temp,1) | eval Sec_ID=upper(Sec_ID) | Where Sec_ID != Logon_Account_Name | stats count by Sec_ID, Logon_Account_Name
... View more