Creating a detailed table to investigate user account logging into several servers

[rcastello]

Hello,

I'm attempting to build a detailed table complete with timestamp, account name, eventcode, and host. We found that there is an account logging into various servers over a period of 48 hours, but I'm having difficulty creating a proper query. The only column that is filled out is host. Here is what I attempted:

index="index" Account_Name="account" EventCode="event code" | stats count BY host | eval timestamp=strftime(_time, "%B %d, %D:%M:%S %p") | table timestamp Account_Name host eventcode

Thank you for any help the community can provide.

[to4kawa]

index="index" Account_Name="account" EventCode="event code" 
| stats count last(_time) as _time by Account_Name host EventCode
| eval timestamp=strftime(_time, "%B %d, %H:%M:%S %p")
| table timestamp Account_Name host EventCode

Hi, @rcastello
Is this result what you want to know?