When the below search is ran, it'll count duplicate failed logons for all users. How do I exclude duplicates in a count?
eventtype=msad-failed-user-logons
(host="*")|fields
_time,signature,src_ip,src_host,src_nt_host,src_nt_domain,user,Logon_Type|stats
count by
user,src_nt_domain,src_ip,|sort
-count|rename user as "Username", src_nt_domain as "Domain", src_ip as
"IP Address"
... View more