topic Re: Find users who have done an event A, but not done an event B in Splunk Search

Find users who have done an event A, but not done an event B

anoopsankar — Thu, 14 May 2015 09:46:22 GMT

I have a splunk log that has fields 'user_id' and 'event'. What I would like to do is to find the list of users who have done an Event A, but has not done an Event B.

The way I have figured out right now uses a sub-search, but the number of items returned by the sub-search causes a more than maxout warning. The query I use is:

event=A user_id NOT [event=B | fields user_id]

What is the alternate way to do this?

Re: Find users who have done an event A, but not done an event B

lguinn2 — Thu, 14 May 2015 18:05:19 GMT

Try this

event=A OR event=B
| stats count(eval(event="A")) as ACount count(eval(event="B")) as Bcount by user_id
| where ACount >= 1 AND BCount < 1

I realize that you are being abstract in your question, so my answer may not have enough details for you. Follow up with more details about event A and event B, if you want a more detailed answer...

Re: Find users who have done an event A, but not done an event B

anoopsankar — Fri, 15 May 2015 05:27:44 GMT

@Iguinn, the answer looks promising. Just to have some more clarity, the events are something like this:
Event A = a user registration event (usually happens only once per user)
Event B = a user doing a payment on our application (could happen many times for a user or never at all).

So what I'm looking at is the list of users who have registered but have not yet done even a single payment. Hope this clarifies.

Thanks!