@jcorkey, change from distinct count i.e. dc() to count i.e. count() | stats count(rectype4) as "Executed sudo command", count(rectype3) as "Switched to different user account" , count(rectype2) as "Added new user to group", count(rectype1) as "Created new user" by user ... View more

you need to set the token from your search. add <set token="user">$click.value2$</set> in your drilldown and use that token in user=$user$ ... View more

Hi jcorkey, if the format of your logs is the one you described in your question, Splunk already extracts acct field. otherwise you have to use a regex like the following | rex "acct\=\"(?<user>[^\"]*)\"" if it doesn'r run, please share an example of your logs. Bye. Giuseppe ... View more

easy peasy ... multisearch [ Your search that finds user1 creating user2 | table _time user1 user2 | eval rectype="create"] [ Your search that finds user1 adding user2 to group2 | table _time user1 user2 group2 | eval rectype="group"] [ Your search that finds user1 becoming user2 | table _time user1 user2 | eval rectype= "switch"] | stats values(rectype) as rectype, min(_time) as starttime, values(group) as group, range(_time) as duration by user1 user2| | where mvcount(rectype)=3 Note that to use multisearch , all of the individual commands use to find the various records must be distributed streaming type commands. If you must use any commands that cannot be distributed, then you need to do something like ( Your search that finds user1 creating user2 ) OR (Your search that finds user1 adding user2 to group2) OR (Your search that finds user1 becoming user2) | eval rectype=case(something that figures out search 1, "create", something that figures out group 2, "group", something that figures out group 3, "switch", true(), "booboo") | eval user1=coalesce(fieldfrom group1, field from group2, field from group3) | eval user2=coalesce(fieldfrom group1, field from group2, field from group3) | eval group2=(field from group2) | stats values(rectype) as rectype, min(_time) as starttime, values(group) as group, range(_time) as duration by user1 user2| | where mvcount(rectype)=3 OR rectype="booboo" ... View more