https://community.splunk.com/t5/Splunk-Search/Reading-in-a-list-of-username-counting-them-and-create/m-p/342022#M101346 <P>I need to read in a file of exchange mailboxes and usernames/accounts, provide the total number of mailboxes, usernames/accounts and compare that number to the count from the previous month and show a graph with the new mailboxes/counts. We have extracted the information using powershell and have imported the info, just not sure how to count the names and provide the comparison, any help is appreciated.</P> Sat, 10 Jun 2017 17:04:49 GMT johnquinn 2017-06-10T17:04:49Z https://community.splunk.com/t5/Splunk-Search/Reading-in-a-list-of-username-counting-them-and-create/m-p/342022#M101346 <P>I need to read in a file of exchange mailboxes and usernames/accounts, provide the total number of mailboxes, usernames/accounts and compare that number to the count from the previous month and show a graph with the new mailboxes/counts. We have extracted the information using powershell and have imported the info, just not sure how to count the names and provide the comparison, any help is appreciated.</P> Sat, 10 Jun 2017 17:04:49 GMT https://community.splunk.com/t5/Splunk-Search/Reading-in-a-list-of-username-counting-them-and-create/m-p/342022#M101346 johnquinn 2017-06-10T17:04:49Z https://community.splunk.com/t5/Splunk-Search/Reading-in-a-list-of-username-counting-them-and-create/m-p/342023#M101347 <P>can you provide a sample of the data you're working with?</P> <P>Have you tried to use the timewrap app to complete this month over month comparison?</P> Sun, 11 Jun 2017 23:40:45 GMT https://community.splunk.com/t5/Splunk-Search/Reading-in-a-list-of-username-counting-them-and-create/m-p/342023#M101347 cmerriman 2017-06-11T23:40:45Z https://community.splunk.com/t5/Splunk-Search/Reading-in-a-list-of-username-counting-them-and-create/m-p/342024#M101348 <P>Just in case, here is the link to the app <A href="https://splunkbase.splunk.com/app/1645/">https://splunkbase.splunk.com/app/1645/</A></P> Sun, 11 Jun 2017 23:42:01 GMT https://community.splunk.com/t5/Splunk-Search/Reading-in-a-list-of-username-counting-them-and-create/m-p/342024#M101348 MuS 2017-06-11T23:42:01Z https://community.splunk.com/t5/Splunk-Search/Reading-in-a-list-of-username-counting-them-and-create/m-p/342025#M101349 <P>While Timewrap App might not be supported for newer version of Splunk, timwrap command is available in SPL itself from Splunk Enterprise 6.5 onward: <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timewrap">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timewrap</A></P> <P>However, as per @cmerriman, do provide some sample data. </P> Mon, 12 Jun 2017 20:23:56 GMT https://community.splunk.com/t5/Splunk-Search/Reading-in-a-list-of-username-counting-them-and-create/m-p/342025#M101349 niketn 2017-06-12T20:23:56Z https://community.splunk.com/t5/Splunk-Search/Reading-in-a-list-of-username-counting-them-and-create/m-p/342026#M101350 <P>This trivial example assumes: that you have loaded the data from both files into index foo, with source bar; that the events have a _time as/of the date of pull or that if you use the date of load that you load the files within the calendar month; that you don't care to know exactly how many were added or deleted, just what the number was; ... and I guess that's it. </P> <PRE><CODE>index=foo source=bar | bin _time span=1mon | stats count by _time </CODE></PRE> Mon, 12 Jun 2017 20:39:13 GMT https://community.splunk.com/t5/Splunk-Search/Reading-in-a-list-of-username-counting-them-and-create/m-p/342026#M101350 DalJeanis 2017-06-12T20:39:13Z https://community.splunk.com/t5/Splunk-Search/Reading-in-a-list-of-username-counting-them-and-create/m-p/342027#M101351 <P>Thank you @cmerriman, niketnilay amd MuS. I cannot attach (not enough points) but included content from may one from june.</P> <PRE><CODE>&gt;&gt;&gt;&gt;May&gt;&gt;&gt;&gt;&gt;&gt; Name WhenCreated WhenCreatedUTC ---- ----------- -------------- George Jones 4/6/2009 8:39:33 AM 4/6/2009 1:39:33 PM Dan Smith 11/28/2011 3:17:23 PM 11/28/2011 9:17:23 PM Kathy Smoke 05/01/2017 8:14:42 AM 05/01/2017 8:14:42 AM Jeffrey Everest 7/22/2010 12:32:00 PM 7/22/2010 5:32:00 PM 1 new users 1 removed users 4 total users &gt;&gt;&gt;&gt;&gt;&gt;&gt;may&gt;&gt; &gt;&gt;&gt;june&gt;&gt;&gt; Name WhenCreated WhenCreatedUTC ---- ----------- -------------- George Jones 4/6/2009 8:39:33 AM 4/6/2009 1:39:33 PM Dan Smith 11/28/2011 3:17:23 PM 11/28/2011 9:17:23 PM Jeffrey Everest 7/22/2010 12:32:00 PM 7/22/2010 5:32:00 PM Kathy Smoke 05/01/2017 8:14:42 AM 05/01/2017 8:14:42 AM Bill Hope 06/01/2017 3:17:23 PM 06/01/2017 3:17:23 PM 1 new users 0 removed users 5 total users &lt;&lt;&lt;&gt;&gt; </CODE></PRE> Mon, 12 Jun 2017 20:41:25 GMT https://community.splunk.com/t5/Splunk-Search/Reading-in-a-list-of-username-counting-them-and-create/m-p/342027#M101351 johnquinn 2017-06-12T20:41:25Z https://community.splunk.com/t5/Splunk-Search/Reading-in-a-list-of-username-counting-them-and-create/m-p/342028#M101352 <P>Is the data ingested in Splunk? If yes, how does it look in Splunk (each line is separate events OR one block for each month or anything else)?</P> Mon, 12 Jun 2017 22:05:33 GMT https://community.splunk.com/t5/Splunk-Search/Reading-in-a-list-of-username-counting-them-and-create/m-p/342028#M101352 somesoni2 2017-06-12T22:05:33Z