Im trying to get the following into a table and have a count of the successful attempts. I have tried a few ways, but still am lost. below are my 2 attempts: Ex1: (index="sfdc" sourcetype="sfdc:loginhistory" eventtype="sfdc_login_history" LoginType="SAML Sfdc Initiated SSO" app="sfdc" action=success)  OR (index="microsoft" (sourcetype="azure:aad:signin" eventtype="azure_aad_signin" app="windows:sign:in" action=success) OR (sourcetype="azure:aad:user" jobTitle!=null)) | eval login=case((sourcetype=="azure:aad:signin" AND eventtype=="azure_aad_signin"), "windows", (sourcetype=="sfdc:loginhistory" AND app="sfdc"), "salesforce") | table displayName  mail jobTitle officeLocation eventtype Ex2: index=microsoft (sourcetype="azure:aad:user" givenName="***" surname="***" jobTitle!="null" officeLocation!="null") OR (sourcetype="azure:aad:signin" eventtype="azure_aad_signin" app="windows:sign:in" action=success)    | stats  count by displayName  mail jobTitle officeLocation     | rename  displayName AS "Display Name" mail AS Email department AS Department jobTitle AS "Job Title" officeLocation AS Branch    | fields  - count     | sort  + Display Name EX3: index=microsoft (sourcetype="azure:aad:signin" eventtype="azure_aad_signin" app="windows:sign:in" action=success) OR (sourcetype="azure:aad:user" givenName="***" surname="***" jobTitle!="null" officeLocation!="null") | eval joiner=if(sourcetype="azure:aad:signin", action, displayName) | stats values(action) as action by displayName mail jobTitle officeLocation | rename displayName AS "Display Name" mail AS Email department AS Department jobTitle AS "Job Title" officeLocation AS Branch | sort + Display Name What I'm trying to achieve here is to have a table listing the following Display Name | Email | Job Title | Branch | Windows Logon Attempt* | Sales Force Login Attempt* Windows Logon Attempt* | Sales Force Login Attempt* - is the part that I get stuck and can't seem to populate the list from the following index and srctype. Ex2 and 3 is without Salesforce (which I can live with ). If you can help he with Ext3 that will be great! Any ideas from the Splunkers in here? Thanks, S ... View more