https://community.splunk.com/t5/Splunk-Search/find-users-who-hasnt-logged-in-the-past-30-days/m-p/570102#M198709 <P>Try something like this</P><LI-CODE lang="markup">| inputlookup Users.csv | eval last_login = strptime('last_login',"%m/%d/%Y %H:%M:%S") | sort 0 last_login desc | stats first(last_login) as last_login by user | where last_login &lt; relative_time(now(),"-30d@d")</LI-CODE> Thu, 07 Oct 2021 18:16:58 GMT ITWhisperer 2021-10-07T18:16:58Z https://community.splunk.com/t5/Splunk-Search/find-users-who-hasnt-logged-in-the-past-30-days/m-p/570094#M198706 <P>Hello! I have a lookup table with fields 'name' and 'last_login'. I'm trying to find users who haven't logged in the past 30 days.&nbsp;<BR />Originally, I had this:</P><P>&nbsp;</P><LI-CODE lang="markup">| inputlookup Users.csv | where strptime('last_login',"%m/%d/%Y %H:%M:%S") &lt; relative_time(now(),"-30d@d") OR isnull(last_login) | sort last_login desc</LI-CODE><P>&nbsp;</P><P>However, it is only outputting users that logged in 30+ days ago. I would like to exclude users who are still logging in recently (in those 30 days). Thank you! Any help would be greatly appreciated!</P> Thu, 07 Oct 2021 17:11:23 GMT https://community.splunk.com/t5/Splunk-Search/find-users-who-hasnt-logged-in-the-past-30-days/m-p/570094#M198706 iiix94 2021-10-07T17:11:23Z https://community.splunk.com/t5/Splunk-Search/find-users-who-hasnt-logged-in-the-past-30-days/m-p/570095#M198707 <P>What is the issue here - assuming your lookup is up to date, the search will do what you are asking for. Or is it that your lookup is not up to date and you want to check more recent events which are not in the lookup?</P> Thu, 07 Oct 2021 17:21:35 GMT https://community.splunk.com/t5/Splunk-Search/find-users-who-hasnt-logged-in-the-past-30-days/m-p/570095#M198707 ITWhisperer 2021-10-07T17:21:35Z https://community.splunk.com/t5/Splunk-Search/find-users-who-hasnt-logged-in-the-past-30-days/m-p/570098#M198708 <P>The lookup is updated with recent login events. This query pulled users who logged in 30 days ago, including users who are still logging in recently. I would like to exclude those users. I would like users whose last login was 30 days ago, so permissions can be removed!</P> Thu, 07 Oct 2021 17:39:38 GMT https://community.splunk.com/t5/Splunk-Search/find-users-who-hasnt-logged-in-the-past-30-days/m-p/570098#M198708 iiix94 2021-10-07T17:39:38Z https://community.splunk.com/t5/Splunk-Search/find-users-who-hasnt-logged-in-the-past-30-days/m-p/570102#M198709 <P>Try something like this</P><LI-CODE lang="markup">| inputlookup Users.csv | eval last_login = strptime('last_login',"%m/%d/%Y %H:%M:%S") | sort 0 last_login desc | stats first(last_login) as last_login by user | where last_login &lt; relative_time(now(),"-30d@d")</LI-CODE> Thu, 07 Oct 2021 18:16:58 GMT https://community.splunk.com/t5/Splunk-Search/find-users-who-hasnt-logged-in-the-past-30-days/m-p/570102#M198709 ITWhisperer 2021-10-07T18:16:58Z https://community.splunk.com/t5/Splunk-Search/find-users-who-hasnt-logged-in-the-past-30-days/m-p/570132#M198714 <P>Hmm.. Not working..</P> Thu, 07 Oct 2021 19:33:09 GMT https://community.splunk.com/t5/Splunk-Search/find-users-who-hasnt-logged-in-the-past-30-days/m-p/570132#M198714 iiix94 2021-10-07T19:33:09Z