https://community.splunk.com/t5/Splunk-Search/search-of-user-logon-count-using-lookup-table-to-return-all/m-p/131978#M35992 <P>Thanks a bunch. The only change I had to make to your command was to add a "| rename count(luser) as count"</P> <P>full command</P> <P>|inputlookup allusers.csv | table luser| eval count=0 | join type=left luser [search source="mysource" "login succeeded" | eval luser=lower(user) | stats count(luser) as count by luser | rename count(luser) as count]</P> Thu, 30 Jan 2014 18:39:07 GMT lindsley 2014-01-30T18:39:07Z https://community.splunk.com/t5/Splunk-Search/search-of-user-logon-count-using-lookup-table-to-return-all/m-p/131976#M35990 <P>Hi,</P> <P>I have a search like this to return the number of times users have logged in over a week.</P> <P>source="mysource" "login succeeded" | eval luser=lower(user) | stats count(luser) by luser</P> <P>I also have a lookup table with all users who have access to the system</P> <P>Is there a way I could make my stats to put out a 0 count for users who are in the lookup table but haven't logged in?</P> Thu, 30 Jan 2014 17:29:43 GMT https://community.splunk.com/t5/Splunk-Search/search-of-user-logon-count-using-lookup-table-to-return-all/m-p/131976#M35990 lindsley 2014-01-30T17:29:43Z https://community.splunk.com/t5/Splunk-Search/search-of-user-logon-count-using-lookup-table-to-return-all/m-p/131977#M35991 <P>Assuming name of the lookup file is allusers.csv and field name in the lookup is luser, try following</P> <PRE><CODE>|inputlookup allusers.csv | table luser| eval count=0 | join type=left luser [search source="mysource" "login succeeded" | eval luser=lower(user) | stats count(luser) as count by luser] </CODE></PRE> Thu, 30 Jan 2014 18:01:03 GMT https://community.splunk.com/t5/Splunk-Search/search-of-user-logon-count-using-lookup-table-to-return-all/m-p/131977#M35991 somesoni2 2014-01-30T18:01:03Z https://community.splunk.com/t5/Splunk-Search/search-of-user-logon-count-using-lookup-table-to-return-all/m-p/131978#M35992 <P>Thanks a bunch. The only change I had to make to your command was to add a "| rename count(luser) as count"</P> <P>full command</P> <P>|inputlookup allusers.csv | table luser| eval count=0 | join type=left luser [search source="mysource" "login succeeded" | eval luser=lower(user) | stats count(luser) as count by luser | rename count(luser) as count]</P> Thu, 30 Jan 2014 18:39:07 GMT https://community.splunk.com/t5/Splunk-Search/search-of-user-logon-count-using-lookup-table-to-return-all/m-p/131978#M35992 lindsley 2014-01-30T18:39:07Z