Not sure you can return a single event for a specific timeframe if there is more than one event. What you can do is use the count(....) field in your report. So say for example you want to report on failed logons, select the username, Count(messageId) or count(referenceID), and Event Computer as your fields in the report. What you will get is count of all failed logons for each user on each event computer on a single line for each evetn computer. Keep in mind that if you select a date time field you will still see every failed logon for the users rather than a count so do not use a date time field in the report. If you want the auditor to see the timeframe you selected for the sample simply include the check mark for date and tiemframe on the last page of the configuration for the report.
