So people will probably need a bit more information in order to answer this question. This means adding details like: 1. windows or Linux or manufacture / appliance name 2. a pasted login event from your logs 3. your full search query syntax from start to finish I'm not sure which OS or Log Type your looking at to know if your seeing login events, or connection events, or file copy events or what. There's a whole slew of login types that we're just gonna overlook here to see if I can help get you something that can work. Assuming you have a perfect log that clarly says 'host=blah user=blah action=Login' and all of those fields are extracted properly, or something of the sort, you could try this: <my_root_search_here> action=Login | stats count by UserName MachineName | sort - count That should give you a table output. ... View more