Working on supplementing a search we are using to implement conditional access policies. The search identifies successful logins and produces a percentage of compliant logins over a period. What I am trying to add, is the last login time which is identified by the "createdDateTime" in the logs.  Here is the current search:  index="audit" sourcetype="signin" userPrincipalName="*domain.com" status.errorCode=0 | eval DeviceCompliance='deviceDetail.isCompliant' | chart count by userPrincipalName DeviceCompliance | eval total=true + false | rename true as compliant | eval percent=((compliant/total)*100) | table userPrincipalName compliant total percent I have tried adding / modifying pipes like "stats latest(createdDateTime) by userPrincilaName compliant total percent" but this is inserting the time into the true / false fields. I feel that I am modifying the data too much up front and maybe need to change around the piping order perhaps? All suggestions welcomed. ... View more

I am working on obtaining all user logins for a specified domain, then displaying what percent of those logins were from compliant devices. I start by creating a couple fields for 'ease of reading' - these fields do produce data as expected, however, the table comes out with 'null' for the percent values. I have tried the below variations in pipeflow unfortunately with similar results - when trying to create a 'total' value by creating then combining compliant and noncompliant to divide, the total field does not have data either. base search | eval DeviceCompliance='deviceDetail.isCompliant' | eval compliant=if(DeviceCompliance="true",DeviceCompliance,null()) | stats count as total by userPrincipalName | eval percent=((compliant/total)*100) | table userPrincipalName total percent base search | eval DeviceCompliance='deviceDetail.isCompliant' | eval compliant=if(DeviceCompliance="true",DeviceCompliance,null()) | eval noncompliant=if(DeviceCompliance="false",DeviceCompliance,null()) | eval total=sum(compliant+noncompliant) | stats count by userPrincipalName | table userPrincipalName compliant total | eval percent=((compliant/total)*100) | table userPrincipalName total percent   ... View more