This is the search result shows as all value are 0 for the above query username datsource count user1 db1 0 user2 db2 0 user1 db2 0 It is showing the correct number of inputlookup testconn file where there is 3 records. But the count is not picking up the user1 connection to datsource of db1, user2 connection to datsource of db2 and user1 datsource of db2. (Note: user1 username is on both db1 and also db2) The result should be something similiar as below. username datsource count user1 db1 8 user2 db2 0 - assume there are no event logs found and should show as 0. user1 db2 6 ... View more

the result shows are with values and compares against all datsource. The results of wanted is that if there based on the inputlookup eg username datsource user1 db1 user2 db2 user1 db2 return results based on fixed number of inputlookup file with 3 username username datsource count(username) user1 db1 10 user2 db2 0 user1 db2 8 ... View more

Hi The above works.. If i need to use two fields in testconn inputlookup file to match against the events the result shows will be all 0 shown. Here is the constructed command. Can advise on this. index=main sourcetype=oracle ACTION_NAME=LOGON [inputlookup testconn|fields username,datsource] | stats count(username) as uTotal,count(source) as sTotal by username datsource | append [ | inputlookup testconn|fields username,datsource | eval uTotal=0,sTotal=0] | stats max(uTotal),max(sTotal) by username datsource The result is to shown username and datsource have total of the access and shown 0 with at the total of the access if there is no access. sample output username datsource uTotal sTotal test1 DB1 10 10 test2 DB2 0 0 test1 DB1 0 0 ... View more

Hi cusello, the suggested query still does append those user that has not login. Is there any other ways to put the value as 0 or '-' for the last_login and source when user does not login. ... View more

There are some user that has the sames name from different source. Have try the above query but it 's return all user login not based on the inputlookup yyyy list. Any suggestion ? ... View more

I still getting not the full listing of the user from inputlookup yyyy file. Any other suggestions ? ... View more

Thank it works for the one ... View more

Hi, where do you configure that ? New to it. Regards, ... View more

Getting the outputs of the table when running "|inputlookup.csv. I have run that suggested command. but still getting the error as "could not find all the specified lookup fields in the lookup table". Any suggestion ? ... View more