That's definitely getting me closer to something workable, @ITWhisperer , and I thank you for that. But that gives me an event count per day, and what I'm trying to figure out is how to count the number of unique days someone logged in from somewhere (not the number of logins themselves). For example, I'd like to be able to filter out someone passing through a state on travel vs. someone who's there every day by filtering on the count being > 5 days. Here's what I've evolved the query to so far, but the final stats count in "Logins" seems to be showing me the total login events, not the count of unique days with login events -- that's my sticking point so far. `m365_default_index` sourcetype="o365:management:activity" Workload=AzureActiveDirectory Operation=UserLoggedIn | iplocation ClientIP | search Country="United States" AND NOT Region="" | bin span=1d _time | stats count by _time ClientIP UserId Region | eval Date=strftime(_time, "%Y-%m-%d") | rename Region AS State UserId AS User ClientIP AS "Client IP" | sort State, User, "Client IP", - Date | table State, User, "Client IP", Date, count | stats count AS Logins by State User | where Logins > 5 It feels like I need something like: | stats count(values(Date)) AS Logins by State User near the end. ... but that doesn't work. Any further advice on counting days in the results to include in an output table would be welcome. Thanks.
... View more
