https://community.splunk.com/t5/Splunk-Search/How-to-know-the-number-of-accounts-that-do-have-not-login-in/m-p/197388#M187393 <P>I'd do this like so:</P> <PRE><CODE>sourcetype=app_a OR sourcetype=app_b | stats values(sourcetype) as sourcetypes dc(sourcetype) as apps by user | where sourcetypes=="app_a" AND apps=1 </CODE></PRE> Fri, 23 Jan 2015 17:06:40 GMT dturnbull_splun 2015-01-23T17:06:40Z https://community.splunk.com/t5/Splunk-Search/How-to-know-the-number-of-accounts-that-do-have-not-login-in/m-p/197386#M187391 <P>How to know the number of accounts that do have not login in over 30 days in application1 but have login in application2</P> Thu, 22 Jan 2015 13:44:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-know-the-number-of-accounts-that-do-have-not-login-in/m-p/197386#M187391 moiezuddin 2015-01-22T13:44:16Z https://community.splunk.com/t5/Splunk-Search/How-to-know-the-number-of-accounts-that-do-have-not-login-in/m-p/197387#M187392 <P>I don't know the fields you have in your logs, so I'll assume that you have the following fields app and username and sourcetype is applogs, so you can make the following searches (and from time picker choose last month):</P> <P>sourcetype=applogs app=application1 | stats count by user </P> <P>sourcetype=applogs app=application2 | stats count by user </P> <P>hope that this help ..</P> Fri, 23 Jan 2015 16:46:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-know-the-number-of-accounts-that-do-have-not-login-in/m-p/197387#M187392 aakwah 2015-01-23T16:46:00Z https://community.splunk.com/t5/Splunk-Search/How-to-know-the-number-of-accounts-that-do-have-not-login-in/m-p/197388#M187393 <P>I'd do this like so:</P> <PRE><CODE>sourcetype=app_a OR sourcetype=app_b | stats values(sourcetype) as sourcetypes dc(sourcetype) as apps by user | where sourcetypes=="app_a" AND apps=1 </CODE></PRE> Fri, 23 Jan 2015 17:06:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-know-the-number-of-accounts-that-do-have-not-login-in/m-p/197388#M187393 dturnbull_splun 2015-01-23T17:06:40Z https://community.splunk.com/t5/Splunk-Search/How-to-know-the-number-of-accounts-that-do-have-not-login-in/m-p/197389#M187394 <P>Please helpme out of it </P> <P>How to right search query to know last login and password reset for (2 applications) application 1 and application2<BR /> Need to write query with below given index and source<BR /> index=ibm source="abmom-tail://ibmarehouse/ibm_account</P> Tue, 03 Feb 2015 14:02:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-know-the-number-of-accounts-that-do-have-not-login-in/m-p/197389#M187394 moiezuddin 2015-02-03T14:02:20Z https://community.splunk.com/t5/Splunk-Search/How-to-know-the-number-of-accounts-that-do-have-not-login-in/m-p/197390#M187395 <P>How to right search query to know last login and password reset for (2 applications) application 1 and application2<BR /> Need to write query with below given index and source<BR /> index=ibm source="abmom-tail://ibmarehouse/ibm_account</P> Tue, 03 Feb 2015 14:02:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-know-the-number-of-accounts-that-do-have-not-login-in/m-p/197390#M187395 moiezuddin 2015-02-03T14:02:28Z