I am trying to create a table that shows the number of distinct users that have logged into a machine. I am having problems getting the domain to appear next to the distinct user count.
Current search& output
index=logs event=logon | dc(username) AS UserCount
Domain UserCount GUEST 20 INTERNAL 72 EXTERNAL 4 WIRELESS 10
I tried various permutations of stats count by, table, and sum, but I just can't seem to figure it out.