I appreciate the TSQL, but it actually doesn't help me. You are using record names and fields, but not all of them are defined in your post. I'll propose some ideas here anyway...
sourcetype=iis OR whateverFindsTheEventsWithMissingUserNames
| eval MissingDatetime=_time
| fields session MissingDatetime
| join session [ search sourcetype=iis OR whateverFindsALLTheEventsThatShouldHaveUserNames ]
| sort session _time
This should give you the sessions where at least one event is missing its user name. To reduce it further, you could add this at the end
| eval secondsDiff = MissingDatetime - _time
| where secondsDiff >= 0 AND secondsDiff <= 1200
This would list all the events that were within the 20 minutes prior to the missing user name event. If this answer doesn't help, can you show a few lines of sample data?
... View more
