Not really, this is what I was looking for: host=adfs.contoso.com EventCode=501 x-ms-forwarded-client-ip | rex "(?\d+\.\d+\.\d+\.\d+)" | rex "(?CHICO.+)" | table user,ip,_time | iplocation ip This last query fixed my issue. I'm not sure if running the | transaction Activity_ID Instance_ID on other queries made Splunk learn/group adfs transactions or if this was being logged all along and I couldn't find it. ... View more

Did you find an answer? I'd love to get a nice UID & IP Report. I am looking up IP's in ADFS logs to track down some things: EventCode=501 [search EventCode=299 [search | table Activity_ID] | table Instance_ID | rename Instance_ID as search] I'm still working to get a better query, but yeah, one query to find Activity ID, then search for the Instance IDs, and the User ID probably needs to be extracted next because it doesn't auto-extract and is in the message text. regex should work otherwise. It would be awesome if their were an addon for this. ... View more