Well, then you might need to apply filter on URL (contains /login.do?sys_action=sysverb_login&user_name=) and Created field of syslog_transaction table, and group by Created By field as follows;
Another approach would be reporting on sysevent table because there is a OOB event known as login.
But to be honest I have never generated reports using these two approaches.
Hopefully this will give you a direction.
