https://community.splunk.com/t5/Getting-Data-In/Help-extracting-user-logins-from-IIS-logs-to-one-report/m-p/477348#M81940 <P>Hello, I'm trying to extract two types of data from IIS logs to sum up the login counts for a list of specific users.</P> <P>The IIS logs contain two entries I'm curious about specifically. If I run this search query, I get the data I'm looking for:</P> <PRE><CODE>index=myindex host=NAMEOFSERVER "POST" "https://url.test.com/adfs/ls/" "/default.aspx" "OAuth+MSAuthHost" AND ("DOMAIN\\User1" OR "DOMAIN\\User2") | chart count by cs_username limit=0 </CODE></PRE> <P>This will return a chart, showing the amount of times those 2 users logged via mobile for a specific time period. Now, I have another search query that gives me data I'm looking for.</P> <PRE><CODE>index=myindex host=NAMEOFSERVER "POST" "https://url.test.com/adfs/ls/" "/default.aspx" NOT "OAuth+MSAuthHost" AND ("DOMAIN\\User1" OR "DOMAIN\\User2") | chart count by cs_username limit=0 </CODE></PRE> <P>This will return the amount of times those 2 users logged in <STRONG>NOT</STRONG> using mobile.</P> <P>What I'm trying to do is combine these two results on to one report, showing a bar chart for User1 and User2 comparing how many times they logged in via mobile (first query) and how many times they didn't (second query).</P> <P>I've tried appendcol, join, just haven't had any luck combining these two datasets. Is it possible?</P> <P>Thank you!</P> Thu, 05 Sep 2019 14:38:12 GMT mwagnerfhlbc 2019-09-05T14:38:12Z https://community.splunk.com/t5/Getting-Data-In/Help-extracting-user-logins-from-IIS-logs-to-one-report/m-p/477348#M81940 <P>Hello, I'm trying to extract two types of data from IIS logs to sum up the login counts for a list of specific users.</P> <P>The IIS logs contain two entries I'm curious about specifically. If I run this search query, I get the data I'm looking for:</P> <PRE><CODE>index=myindex host=NAMEOFSERVER "POST" "https://url.test.com/adfs/ls/" "/default.aspx" "OAuth+MSAuthHost" AND ("DOMAIN\\User1" OR "DOMAIN\\User2") | chart count by cs_username limit=0 </CODE></PRE> <P>This will return a chart, showing the amount of times those 2 users logged via mobile for a specific time period. Now, I have another search query that gives me data I'm looking for.</P> <PRE><CODE>index=myindex host=NAMEOFSERVER "POST" "https://url.test.com/adfs/ls/" "/default.aspx" NOT "OAuth+MSAuthHost" AND ("DOMAIN\\User1" OR "DOMAIN\\User2") | chart count by cs_username limit=0 </CODE></PRE> <P>This will return the amount of times those 2 users logged in <STRONG>NOT</STRONG> using mobile.</P> <P>What I'm trying to do is combine these two results on to one report, showing a bar chart for User1 and User2 comparing how many times they logged in via mobile (first query) and how many times they didn't (second query).</P> <P>I've tried appendcol, join, just haven't had any luck combining these two datasets. Is it possible?</P> <P>Thank you!</P> Thu, 05 Sep 2019 14:38:12 GMT https://community.splunk.com/t5/Getting-Data-In/Help-extracting-user-logins-from-IIS-logs-to-one-report/m-p/477348#M81940 mwagnerfhlbc 2019-09-05T14:38:12Z