https://community.splunk.com/t5/Splunk-Search/splunk-search-query/m-p/578431#M201588 <P>Hi</P><P>expecting that your log message is in field named message</P><LI-CODE lang="markup">index=&lt;your index&gt; | stats last(message) by user | where user IN ("user1", "user2", "user3")</LI-CODE><P>Based on amount of your user etc. it could be better to switch where before stats.</P><P>r. Ismo&nbsp;</P> Wed, 15 Dec 2021 08:48:57 GMT isoutamo 2021-12-15T08:48:57Z https://community.splunk.com/t5/Splunk-Search/splunk-search-query/m-p/578429#M201586 <P>suppose if i have user1,user2,user3 i need to find out last log message of each user h</P> Wed, 15 Dec 2021 08:11:43 GMT https://community.splunk.com/t5/Splunk-Search/splunk-search-query/m-p/578429#M201586 kajalchopade071 2021-12-15T08:11:43Z https://community.splunk.com/t5/Splunk-Search/splunk-search-query/m-p/578431#M201588 <P>Hi</P><P>expecting that your log message is in field named message</P><LI-CODE lang="markup">index=&lt;your index&gt; | stats last(message) by user | where user IN ("user1", "user2", "user3")</LI-CODE><P>Based on amount of your user etc. it could be better to switch where before stats.</P><P>r. Ismo&nbsp;</P> Wed, 15 Dec 2021 08:48:57 GMT https://community.splunk.com/t5/Splunk-Search/splunk-search-query/m-p/578431#M201588 isoutamo 2021-12-15T08:48:57Z https://community.splunk.com/t5/Splunk-Search/splunk-search-query/m-p/578438#M201592 <P>suppose if i have lots of user not only 3 user so how can i used by using IN</P> Wed, 15 Dec 2021 09:43:10 GMT https://community.splunk.com/t5/Splunk-Search/splunk-search-query/m-p/578438#M201592 kajalchopade071 2021-12-15T09:43:10Z