I have many users but they all user the same ID to log in. Is there anyway to tell them apart from the IP address of there PC, or something like that?

[robertlynch2020]

I have used this
index=_audit action="login attempt" "info=succeeded" | stats count by action , user , _time | timechart span=1d count by user

But all the users get put into the same bucket.

[PPape]

this shows you the actions by user and IP

index=_internal sourcetype=splunkd_ui_access | stats count by clientip , user , _time | eval UserIP=user+" - "+clientip | timechart span=1d count by UserIP