How to split stats results into single line item for each event

[SplunkLunk]

Greetings,

I'm trying to find when a user logs (or tries to log) into six different workstations over the course of 24 hours. My current query looks like this:

index=[myindex] source=[mysource] Action=0 OR Action=1
|stats count(Terminal) as Workstation, values(Terminal) as Terminal, values(Action) as Action by Logon
|where mvcount(Terminal)>5

Action=0 is success, Action=1 is failure, and Logon is the username. I get the aggregate results that I want. For example, I can see that user "X" logged in eight times with six different workstations. Now I want to split each of those into their individual events. Then I can make a table with the time for each attempt with the respective workstation as well as include some other info about the event. I tried just adding a table command at the end but that didn't work. Can anyone tell me the best way to do what I'm asking? Thanks.

[somesoni2 · Accepted solution]

Try like this

index=[myindex] source=[mysource] Action=0 OR Action=1
| eventstats dc(Terminal) as TerminalsUsed by Logon |where TerminalsUsed>5
| table _time Terminal Action Logon ...anyotherfieldyouneed...

[SplunkLunk]

Thanks. That works!