Search query for showing Connection attempts per user to same Destination

[neerajs_81]

Hello All,
I have a query that searches the Windows Security Logs and shows results in the following format using a stats function .  As you can see , i am grouping connection attempts from multiple users to a particular Dest .
Also,  the "Connection Attempts" takes into account the total # for all the users listed under "User" per row.

index=xxx source="WinEventLog:Security" EventCode=4624
| stats values(dest_ip), values(src), values(src_ip),values(user), dc(user) as userCount, count as "Connection Attempts" by dest

Dest	Dest_IP	Src	SRC_IP	userCount	User	Connection Attempts
XX	XXXX	XXX	XXX	3	User A User B User C	9
XX	XXXX	XXX	XXX	2	User D User E	78

I would like to show how many connection attempts were made by each user.  How to segregate this data per user ?

[PickleRick]

If you aggregate, there's no way to "unaggregate" so instead of doing values(user) you'd need to just do your stats "by dest user". But then you lose the overall aggregation on dest.

Sorry, these are two different aggregations and you have to do them separately if you want to have two charts - one by user and one by dest.