index=wineventlog EventCode=4740 host=* | stats count by Account_Name, Computer_Name, IP | stats list(Computer_Name) as Computer_Name, list(IP) as IP, count(Account_Name) as Count by Account_Name | sort - Count @jcolon68, this groups Account_Names together and still counts them.
... View more