The in function used with the where command has a very different syntax from the IN operator used with the search command. An additional complication is neither in nor IN work well with the multi-value fields returned by stats. For that, you probably want mvfind or do the filtering before stats. index IN ("pisupport", "pisupport-np") sourcetype=PIMessage
("procbook" AND "Successful Login")
| rex field=_raw "Identity\sList:\s(?<identity>[^.]+)"
| rex field=_raw "Username\s:\s(?<username>[^.]+)"
| stats count AS Total_Connections, latest(_time) AS Latest_Timestamp, values(identity) AS Security_Mapping, values(host) AS Connected_Hosts, values(username) as LanID by username
| eval discard=if(isnull(mvfind(LanID, "NAM\\OT00564|NAM\\CHawki5")),1,0)
| where discard=1
| sort - Latest_Timestamp
| eval Latest_Timestamp=strftime(Latest_Timestamp, "%Y-%m-%d %H:%M:%S")
| table Latest_Timestamp, Total_Connections, LanID, Connected_Hosts, Security_Mapping
... View more