Thanks a bunch. The only change I had to make to your command was to add a "| rename count(luser) as count"
full command
|inputlookup allusers.csv | table luser| eval count=0 | join type=left luser [search source="mysource" "login succeeded" | eval luser=lower(user) | stats count(luser) as count by luser | rename count(luser) as count]
... View more