The relevant Cisco ISE fields are: user AD_User_Resolved_DNs User_Name UserName The one that matched the LDAP query best is "AD_User_Resolved_DNs" as it matches the case format (upper or lower). So far, I've tried the search string you provided and it is not pulling in the correct data. I see the usernames, but it includes people who logged in to the VPN within the specified time frame from the time picker. sourcetype="cisco:ise:syslog" NetworkDeviceName="MYVPN" action=failure OR action=success PIX7x_Tunnel_Group_Name=MYVPNGroup | rename AD_User_Resolved_DNs as Username | eval type = "ise" | append [ | ldapsearch domain=MYDOMAIN search="(&(objectClass=user) memberOf=CN=MyGroup,OU=Groups,DC=Mydomain,DC=com))" | rename sAMAccountName as Username | eval type = "ldap" ] | stats dc(type) as count values(type) as types by Username | where count=1 AND types="ldap" ... View more