Hi @quangnm21 ,
after every stats command (also tstats) you have only the fields that are present in the command, so dest_nt_domain and src_nt_domain aren't still present.
You have to insert in the tstats command the two fields with the values option:
| tstats `security.content.summariesonly`
values(host) AS srcHost
dc(host) AS chost
min(_time) AS firstTime
max(_time) AS lastTime
values(Authentication.dest_nt_domain) AS dest_nt_domain
values(Authentication.src_nt_domain) AS src_nt_domain
FROM datamodel=Authentication
WHERE Authentication.action="success" Authentication.dest_nt_domain="PTIT" Authentication.src_nt_domain="PTIT" Authentication.user="qmn"
BY Authentication.user
| eval
abc = tostring(dest_nt_domain),
xyz = tostring(src_nt_domain)
Then I hint to rename some fields avoiding the dot in the name (sometimes functions don't work).
Last doubt: if you have the Authentication.user field in the WHERE condition, why do you have it also in the BY cluse? it's always one value!
Last thing: please next time use, in addition to the screenshots, add also the search in text mode (using the "Insert/Edit code sample" button) , so I don't need to rewrite it!
Ciao.
Giuseppe
