Figured it out using a join. host=ADFS* sourcetype="WinEventLog:Security" (EventCode=4624 OR EventCode=501 OR EventCode=299 OR EventCode=410) | fields _time, Account_Name, Security_ID, Activity_ID, Instance_ID, X_MS_Forwarded_Client_IP, EventCode | eval Account_Name=mvindex(Account_Name, 1) | rex field=X_MS_Forwarded_Client_IP mode=sed "s/(,\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})//" | transaction Security_ID Activity_ID Instance_ID maxspan=10s startswith=EventCode=4624 endswith=EventCode=410 | join X_MS_Forwarded_Client_IP [ search index="its-o365-audit" Status=Delivered SenderAddress="<>" FromIP!=129.100.* FromIP!=10.* | top 100 FromIP | search count>5 | table FromIP | rename FromIP as X_MS_Forwarded_Client_IP ] | rename X_MS_Forwarded_Client_IP as IP | stats count by Account_Name, IP ... View more