https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-no-of-users-who-didn-t-logged-in-some-X/m-p/152279#M185564 <P>Thanks for your response , Its worked. I appreciate. </P> Mon, 02 Mar 2015 06:29:30 GMT moiezuddin 2015-03-02T06:29:30Z https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-no-of-users-who-didn-t-logged-in-some-X/m-p/152276#M185561 <P>How to find out the no of users who didn't logged in some X application. and its percentage.???? </P> Fri, 27 Feb 2015 09:46:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-no-of-users-who-didn-t-logged-in-some-X/m-p/152276#M185561 moiezuddin 2015-02-27T09:46:19Z https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-no-of-users-who-didn-t-logged-in-some-X/m-p/152277#M185562 <P>Which application, Splunk application or custom application? If later, does your splunk has logon data indexed from that application? </P> Fri, 27 Feb 2015 23:16:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-no-of-users-who-didn-t-logged-in-some-X/m-p/152277#M185562 somesoni2 2015-02-27T23:16:07Z https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-no-of-users-who-didn-t-logged-in-some-X/m-p/152278#M185563 <P>Questions that ask "who did NOT login" or "which forwarder is NOT sending data" are always harder in Splunk. You can search the data in Splunk, but generally the data is what DID happen. So if I get a list of users from Splunk who logged in (probably easy) - how does Splunk know what is MISSING?</P> <P>Somehow, you need to give Splunk a list of things (users, hosts, return codes or whatever) that SHOULD be there. Sometimes, the easiest way to do this is with a lookup. Imagine that you have created a user lookup table. (Lookup tutorial is <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchTutorial/Usefieldlookups">here</A>.)</P> <P>The csv file could look like this, or it could be more complicated:</P> <PRE><CODE>user lguinn somesoni2 moiezudden jdoe etc... </CODE></PRE> <P>If the lookup is named user_lookup and the field in your Splunk data is called <CODE>user</CODE> too, you can do this:</P> <PRE><CODE>| inputlookup user_lookup | join type=outer user [ search &lt;yoursearchhereforlogins&gt; | stats count by user ] | fillnull | where count = 0 </CODE></PRE> <P>This should give you a list of folks who have not logged in during your search interval.</P> <P>I am not sure how you want to count the percentage. If what you want to know is "what percent of users have not logged in?" you can do the following:</P> <PRE><CODE>| inputlookup user_lookup | join type=outer user [ search &lt;yoursearchhereforlogins&gt; | stats count as LoginCount by user ] | fillnull | eventstats count as TotalUsers count(eval(LoginCount=0)) as NeverLoggedIn | eval PercentNotLoggedIn = round(NeverLoggedIn*100/TotalUsers,1) | where LoginCount = 0 | stats first(PercentNotLoggedIn) as "Percent Never Logged In" values(user) as "User Names" </CODE></PRE> Sat, 28 Feb 2015 20:04:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-no-of-users-who-didn-t-logged-in-some-X/m-p/152278#M185563 lguinn2 2015-02-28T20:04:57Z https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-no-of-users-who-didn-t-logged-in-some-X/m-p/152279#M185564 <P>Thanks for your response , Its worked. I appreciate. </P> Mon, 02 Mar 2015 06:29:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-no-of-users-who-didn-t-logged-in-some-X/m-p/152279#M185564 moiezuddin 2015-03-02T06:29:30Z