https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-view-all-occurrences-of-an-event/m-p/251174#M75033 <P>Insert the list of email to monitor in a lookup and try something like this</P> <PRE><CODE>| inputlookup email_lookup.csv | eval count=0 | append [ search yoursearch | stats values(_time) AS _time count by email ] | stats values(_time) AS _time sum(count) AS Total by email </CODE></PRE> <P>In this way you have for each email the sum of events and the list of timestamps, and 0 for emails without events.<BR /> Bye.<BR /> Giuseppe </P> Tue, 11 Oct 2016 16:28:05 GMT gcusello 2016-10-11T16:28:05Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-view-all-occurrences-of-an-event/m-p/251170#M75029 <P>Every time a user logs in, there is a log statement generated. I am currently running a search for a specific set of users:</P> <PRE><CODE>(index=* OR index=_*) Message:LoginActivity:loggedIn email="email1@gmail.com" OR email="email2@gmail.com" OR email="email3@gmail.com" </CODE></PRE> <P>How would I get a table that shows all of the e-mails, how many times they logged in, and the timestamps of each login? I would envision the table looking something like:<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2009i71D628EB7A470675/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 11 Oct 2016 16:03:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-view-all-occurrences-of-an-event/m-p/251170#M75029 emamedov 2016-10-11T16:03:41Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-view-all-occurrences-of-an-event/m-p/251171#M75030 <P>Try this</P> <PRE><CODE>base search | stats count as "Number of Logins" values(_time) as Timestamps by Email </CODE></PRE> Tue, 11 Oct 2016 16:06:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-view-all-occurrences-of-an-event/m-p/251171#M75030 sundareshr 2016-10-11T16:06:52Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-view-all-occurrences-of-an-event/m-p/251172#M75031 <P>That works to get the e-mails that are in the query. There are multiple OR statements (I am trying to identify if a specific set of users have logged in). Is there any way to include the emails in the conditional statement, and if there are no events, present a 0. The purpose of this would be to see who hasn't logged in.</P> Tue, 11 Oct 2016 16:10:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-view-all-occurrences-of-an-event/m-p/251172#M75031 emamedov 2016-10-11T16:10:20Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-view-all-occurrences-of-an-event/m-p/251173#M75032 <P>Where do you get the specific set of users? Is that in a .csv file somewhere? If it is, you can create a <CODE>lookup</CODE> file of all emails and try something like this (lookup file must have a field called email and data should be identical with index data)</P> <PRE><CODE>| inputlookup lookupfilewithemailsids.csv | where NOT [ search (index= OR index=_) Message:LoginActivity:loggedIn email=* | table email ] | table email | eval count=0 </CODE></PRE> Tue, 11 Oct 2016 16:22:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-view-all-occurrences-of-an-event/m-p/251173#M75032 sundareshr 2016-10-11T16:22:20Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-view-all-occurrences-of-an-event/m-p/251174#M75033 <P>Insert the list of email to monitor in a lookup and try something like this</P> <PRE><CODE>| inputlookup email_lookup.csv | eval count=0 | append [ search yoursearch | stats values(_time) AS _time count by email ] | stats values(_time) AS _time sum(count) AS Total by email </CODE></PRE> <P>In this way you have for each email the sum of events and the list of timestamps, and 0 for emails without events.<BR /> Bye.<BR /> Giuseppe </P> Tue, 11 Oct 2016 16:28:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-view-all-occurrences-of-an-event/m-p/251174#M75033 gcusello 2016-10-11T16:28:05Z