https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581627#M15833 <P>You will have to give us some more details - what do the events you are working with look like? which fields have already been extracted? what searches are you using to get the list of users? what have you tried so far?</P> Wed, 19 Jan 2022 12:53:49 GMT ITWhisperer 2022-01-19T12:53:49Z https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581614#M15830 <P>Supposed if i have huge data of users i need to check the last status of the each users Like login and logout. If user have last status as log out i need to show user info in the table format with status sign out&nbsp;</P> Wed, 19 Jan 2022 12:04:12 GMT https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581614#M15830 kajalchopade071 2022-01-19T12:04:12Z https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581616#M15831 <LI-CODE lang="markup">| sort - _time | dedup user | where status="Logged out"</LI-CODE> Wed, 19 Jan 2022 12:12:52 GMT https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581616#M15831 ITWhisperer 2022-01-19T12:12:52Z https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581620#M15832 <P>Thank you for help but its not working. Can you please help me</P> Wed, 19 Jan 2022 12:22:44 GMT https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581620#M15832 kajalchopade071 2022-01-19T12:22:44Z https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581627#M15833 <P>You will have to give us some more details - what do the events you are working with look like? which fields have already been extracted? what searches are you using to get the list of users? what have you tried so far?</P> Wed, 19 Jan 2022 12:53:49 GMT https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581627#M15833 ITWhisperer 2022-01-19T12:53:49Z https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581630#M15834 <P>So previously i used last(status),stats, count, like wise&nbsp;</P><P>Eg:-stats last(status)as status by sn l where status ="Failed "</P> Wed, 19 Jan 2022 12:57:54 GMT https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581630#M15834 kajalchopade071 2022-01-19T12:57:54Z https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581631#M15835 <P><SPAN>Eg:-stats last(status)as status by sn l where status ="Sign out"</SPAN></P> Wed, 19 Jan 2022 12:59:21 GMT https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581631#M15835 kajalchopade071 2022-01-19T12:59:21Z https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581633#M15836 <P>You could try latest rather than last</P> Wed, 19 Jan 2022 13:03:01 GMT https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581633#M15836 ITWhisperer 2022-01-19T13:03:01Z https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581634#M15837 <P>Tried but its not showing any data. It says no results found.&nbsp;</P> Wed, 19 Jan 2022 13:05:06 GMT https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581634#M15837 kajalchopade071 2022-01-19T13:05:06Z https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581636#M15838 <P>OK so imagine that I told you I wanted to get the last transaction each user had made on my system, what information would you need from me in order to be able to help me? You need to provide more information if you want to stand any chance of someone being able to help you.</P> Wed, 19 Jan 2022 13:12:47 GMT https://community.splunk.com/t5/Security/Splunk-search-query/m-p/581636#M15838 ITWhisperer 2022-01-19T13:12:47Z