Hi, for example index=M365 type=logged in | stats count(username) as usernamecount by username,hostname. by this query we are getting expected results such as username,hostname. however we need a field where system count can be shown for the userloggedIn. By trying below command, we are getting the number of times users logged in to the systems, but we require system count a user logged in index=M365 type=logged in | stats count(username) as usernamecount by username,hostname | where usernamecount>1
... View more