Hi, I'm trying to combine my three searches so I can see which users are logging in from multiple locations at one time. At the moment, I have these three searches. index=mensa_exchange-prod sourcetype=iis cs_uri_stem="/owa/auth.owa" NOT LogoffReason=* OriginalIP=* | iplocation OriginalIP | search Country=* NOT Country="United States"| rex field=user "\w{3}\\\(?\S+)" | eval User=lower(user) |table User Country | stats values(Country) as country dc(Country) as Count by User | sort User index=mensa_radius-prod acct_status_type=1 acct_delay_time=0 vendor=Reserved NOT Wireless | iplocation tunnel_client_endpoint | search Country=* NOT Country="United States" | rex field=user "\w{3}\\\(?\S+)" | eval User=lower(user) | table User Country | stats values(Country) as Country dc(Country) as Count by User | sort User index=mensa_radius-prod vendor=Microsoft NOT Wireless | transaction user, Client_Friendly_Name maxspan=1 startswith=acct_session_id=* endswith=action=success | iplocation tunnel_client_endpoint | search Country=* NOT Country="United States" | rex field=user "\w{3}\\\(?\S+)" | eval User=lower(user) |table User Country | stats values(Country) as country dc(Country) as Count by User | sort User I was thinking the way to do this is to use a join; however, I don't know how that works if I have a transaction command. Is there another way to use this or do I have to use a JOIN? If I do use a join, how would I go about it? Thanks! ... View more

Hello, I'm trying to normalize a field during search. I have the field "user" and some of the fields are "NAU\abc123". I'm trying to remove the prefix "NAU\". All I want is the abc123 part of it. Is there a way to remove that prefix in search? Thanks in advance. ... View more