topic Re: Users who have never logged in. in Splunk Search

Users who have never logged in.

sanju005ind — Fri, 04 Feb 2011 09:41:22 GMT

How do i find users who have never logged in.I have the total list of users available in a lookup file.

Re: Users who have never logged in.

Oranges — Fri, 04 Feb 2011 10:00:57 GMT

Users who have not logged into what?

Re: Users who have never logged in.

gkanapathy — Fri, 04 Feb 2011 10:40:20 GMT

In general, it would be something like:

| inputlookup useridlist | search NOT [ search sourcetype=loginactivity | fields userid ]

Re: Users who have never logged in.

sanju005ind — Fri, 04 Feb 2011 13:35:35 GMT

Re: Users who have never logged in.

sanju005ind — Fri, 04 Feb 2011 14:01:34 GMT

Is there no other way of checking if a user has not logged into splunk other then eliminating by checking those who logged in.I mean in the inner search how far back in time should I check to determine if a user has never logged in.

Re: Users who have never logged in.

Ron_Naken — Sat, 05 Feb 2011 03:29:07 GMT

Using Gerald's example, you could do this:

| inputcsv allusers.csv | search NOT [ search index=_internal (sourcetype=splunk_web_access OR sourcetype=splunkd_access) | fields user | dedup user ]

Your allusers.csv would look like this:

user
bob
jim

The first line (i.e. "user" in this example) is the field name. It's easiest to stick with "user", since this is the field in _internal.