topic Re: How to identify users (UID) that use program A, but have never used program B? in Splunk Search

How to identify users (UID) that use program A, but have never used program B?

Cox_JoshS — Thu, 09 Oct 2014 21:52:00 GMT

I've got users using 2 apps that I'm pulling from, and I'm looking at login reports. Given that the users have unique IDs (UID) and unique app names (AppName), I want to figure out which unique users are using app A but NOT using app B. They can be using both, and I want to see which users have never used app B.

Is this possible through Splunk, or do I need to print them to a CSV and go from there?

Thanks for any help!

Re: How to identify users (UID) that use program A, but have never used program B?

musskopf — Fri, 10 Oct 2014 04:10:19 GMT

Hello,

Try a simple sub-search to exclude users:

index=my_index AND AppName="A" AND NOT [ search index=my_index AppName="B" | dedup UID | fields UID ] | dedup UID | table UID

The sub-search will basically list every unique UID that used App B, so we get the results and exclude from the users using app A. Now, if you have a user that never used App A neither App B, it won't show... if that might be a problem you need to use another source, list a list of UIDs instead of start with users using App A. Hope it all makes sense for you.

Cheers,

Re: How to identify users (UID) that use program A, but have never used program B?

Cox_JoshS — Mon, 28 Sep 2020 17:51:01 GMT

Thanks Musskopf!

So, let's see if I understand correctly -

index=my_index AND AppName="A" -- finding the users that use app "A"

[ search index=my_index AppName="B" | dedup UID | fields UID ] -- find all users using app "B", remove duplicates, strip all other fields

index=my_index AND AppName="A" AND NOT [ search index=my_index AppName="B" | dedup UID | fields UID ]

This combination I'm a little confused about, but if I'm correct this is saying 'if a given item is in the app "A" group, AND NOT in the app "B" group?

Then you take all of it, strip the duplicates, and make a table.

Re: How to identify users (UID) that use program A, but have never used program B?

Cox_JoshS — Fri, 10 Oct 2014 17:27:51 GMT

Yep, this has it for me. Thanks again!

Re: How to identify users (UID) that use program A, but have never used program B?

musskopf — Sun, 12 Oct 2014 21:31:36 GMT

Yeah, you got it!