https://community.splunk.com/t5/Splunk-Search/Help-with-diff-or-eval/m-p/105806#M27479 <P>Perhaps <CODE>transaction</CODE> would be better suited for your scenario.</P> <P>You could do something like</P> <PRE><CODE>eventtype1 OR eventtype2 | transaction user | search eventtype1 AND NOT eventtype2 </CODE></PRE> Mon, 29 Oct 2012 17:49:57 GMT Ayn 2012-10-29T17:49:57Z https://community.splunk.com/t5/Splunk-Search/Help-with-diff-or-eval/m-p/105805#M27478 <P>I have one search, for one event type, and a second search for a second event type. one is 'user login' and the other is 'user logout', right? Ideally in the search i am trying to create, the result set would be all of the users that have logged in, and that have not logged out.</P> <P>I tried to use diff, but I don't know if that function is the best to use for this?</P> <P>I'm still pretty new to Splunk, so please take a look. </P> <P>My search looks like this:<BR /> <SEARCH for="" event="" type="" 1=""> | join user(subsearch for eventtype 2) | dedup user | table _time,host,user,ip</SEARCH></P> <P>this seems to give me all of the users that have logged in, and logged out. I'm looking for those that have logged in, and that have NOT logged out. any ideas? </P> Mon, 29 Oct 2012 17:30:04 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-diff-or-eval/m-p/105805#M27478 tmarlette 2012-10-29T17:30:04Z https://community.splunk.com/t5/Splunk-Search/Help-with-diff-or-eval/m-p/105806#M27479 <P>Perhaps <CODE>transaction</CODE> would be better suited for your scenario.</P> <P>You could do something like</P> <PRE><CODE>eventtype1 OR eventtype2 | transaction user | search eventtype1 AND NOT eventtype2 </CODE></PRE> Mon, 29 Oct 2012 17:49:57 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-diff-or-eval/m-p/105806#M27479 Ayn 2012-10-29T17:49:57Z https://community.splunk.com/t5/Splunk-Search/Help-with-diff-or-eval/m-p/105807#M27480 <P>I believe it's closer, I think I will still have to fiddle with this to get it right. </P> <P>Thank you so much! I'm sure ill be back. <span class="lia-unicode-emoji" title=":grinning_face_with_big_eyes:">😃</span></P> Mon, 29 Oct 2012 20:06:05 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-diff-or-eval/m-p/105807#M27480 tmarlette 2012-10-29T20:06:05Z https://community.splunk.com/t5/Splunk-Search/Help-with-diff-or-eval/m-p/105808#M27481 <P>This did work with some more monkeying! Thank you!</P> Wed, 17 Apr 2013 15:17:32 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-diff-or-eval/m-p/105808#M27481 tmarlette 2013-04-17T15:17:32Z