trim did not make any difference. ... View more

The raw data that I have provided is what the two log events look like. But when I run your search I do not get all data  This is what the result looks like       ... View more

The problem is that I need to count the sourcetype1 events and get the status. Combine this with the Username from sourcetype2. Either I get correct count and Status but no username or I get username but wrong count and status ... View more

I do not know how to type a search to get the output that I stated. That is what I'm looking for a way to present the information that way. ... View more

Also I get no count value. I need number of logins per user and the status of each login E.g. Username, Status Logins xx@xx.xx   success  5                        failed        2  yy@yy.yy   success  2                       failed        4 ... View more

Now the Status field is missing. commonId Status Username xxxxxx                        xxxxxxxxxx ... View more

{"attributes": {"type": "User", "url": "xxxxx"}, "LastModifiedDate": "xxxxx", "City": xxxxx, "Country": xxxxx, "FirstName": "xxxxx", "Id": "xxxxx", "IsActive": xxxxx, "LastLoginDate": "xxxxx", "LastName": "xxxxx", "Latitude": xxxxx, "Longitude": xxxxx, "MobilePhone": xxxxx, "Name": "xxxxx", "PostalCode": xxxxx, "State": xxxxx, "Username": "xxxxx", "UserRoleId": xxxxx, "UserType": "xxxxx", "Email": "xxxxx", "CompanyName": xxxxx, "ProfileId": "xxxxx", "Profile": {"attributes": {"type": "Profile", "url": "xxxxx"}, "PermissionsApiEnabled": xxxxx, "PermissionsModifyAllData": xxxxx, "PermissionsViewSetup": xxxxx}, "UserAccountId": "xxxxx"}     {"attributes": {"type": "LoginHistory", "url": "xxxxx"}, "ApiType": xxxxx, "ApiVersion": "xxxxx", "Application": "xxxxx", "Browser": "xxxxx", "ClientVersion": "", "Id": "xxxxx", "LoginTime": "xxxxx", "LoginType": "xxxxx", "LoginUrl": "xxxxx", "LoginGeoId": "xxxxx", "xxxxx": {"attributes": {"type": "xxxxx", "url": "xxxxx"}, "City": "xxxxx", "Latitude": xxxxx, "Longitude": xxxxx}, "Platform": "xxxxx", "SourceIp": "xxx.xxx.xxx.xxx", "Status": "xxxxx", "UserId": "xxxxx", "UserAccountId": "xxxxx"} ... View more

Returns empty username field commonId Status Username xxxxxxxxx Success ... View more

sourcetype1: { [-] ApiType: xxxxx ApiVersion: xxxxx Application: xxxxx Browser: xxxxx ClientVersion: xxxxx Id: xxxxx LoginGeo: {[+] } LoginGeoId: xxxxx LoginTime: xxxx-xx-xx xx:xx:xx LoginType: xxxxx LoginUrl: xxxxx Platform: xxxxx SourceIp: xxxxx Status: xxxxx UserAccountId: xxxxx UserId: xxxxx attributes: { [+] } } sourcetype2: { [-] City: xxxxx CompanyName: xxxxx Country: xxxxx Email: xxxxx FirstName: xxxxx Id: xxxxx IsActive: xxxxx LastLoginDate: xxxx-xx-xx xx:xx:xx LastModifiedDate: xxxx-xx-xx xx:xx:xx LastName: xxxxx Latitude: xxxxx Longitude: xxxxx MobilePhone: xxxxx Name: xxxxx PostalCode: xxxxx Profile: { [+] } ProfileId: xxxxx State: xxxxx UserAccountId: xxxxx UserRoleId: xxxxx UserType: xxxxx Username: xxxxx attributes: { [+] } } ... View more