Hi @gcusello  I'm getting a "Error in 'stats' command: The argument 'AS' is invalid." for both searches.  Any ideas? ... View more

HI @gcusello  I am getting results from:  index=_audit earliest=-90d latest=now | stats count BY user | append [ | rest splunk_server=local /services/authentication/users | rename title AS user | eval count=0 | fields user count ] | stats sum(count) AS Total BY user | where Total=0 | table user But I want to include the timestamp from when they last logged in within that period and then potentially include it on the dashboard we have setup. ... View more

I have used this and it works but how can I add the timestamp of their last login? ... View more