https://community.splunk.com/t5/Splunk-Search/splunk-search-query/m-p/578440#M201593 <P>if i have employees list .for each employee there are two status logged in and logged out, i need to find out the each users last status and if user last status is logged out i need to count how many employees get logged out</P> Wed, 15 Dec 2021 10:15:43 GMT kajalchopade071 2021-12-15T10:15:43Z https://community.splunk.com/t5/Splunk-Search/splunk-search-query/m-p/578440#M201593 <P>if i have employees list .for each employee there are two status logged in and logged out, i need to find out the each users last status and if user last status is logged out i need to count how many employees get logged out</P> Wed, 15 Dec 2021 10:15:43 GMT https://community.splunk.com/t5/Splunk-Search/splunk-search-query/m-p/578440#M201593 kajalchopade071 2021-12-15T10:15:43Z https://community.splunk.com/t5/Splunk-Search/splunk-search-query/m-p/578441#M201594 <LI-CODE lang="markup">| stats last(status) as status by user | stats count(eval(status="logged out")) as logged_out_users</LI-CODE> Wed, 15 Dec 2021 10:26:48 GMT https://community.splunk.com/t5/Splunk-Search/splunk-search-query/m-p/578441#M201594 ITWhisperer 2021-12-15T10:26:48Z