I'm trying to make one search that will accomplish the following:
Total Login Attempts: DC(USERID) WHERE ACTIVITY = "LOGIN"
Total Login Successes: DC(USERID) WHERE ACTIVITY = "LOGIN" AND RESULT="SUCCESS"
Total Logoff Attempts: DC(USERID) WHERE ACTIVITY = "LOGOFF"
Total Logoff Successes: DC(USERID) WHERE ACTIVITY = "LOGOFF" AND RESULT=SUCCESS"
All of the necessary data can be gathered in one search, Im just having trouble splitting it with chaining conditions. Is there a way to accomplish this by only running the search once?
... View more