Splunk Search

Find users who have done an event A, but not done an event B


I have a splunk log that has fields 'user_id' and 'event'. What I would like to do is to find the list of users who have done an Event A, but has not done an Event B.

The way I have figured out right now uses a sub-search, but the number of items returned by the sub-search causes a more than maxout warning. The query I use is:

event=A user_id NOT [event=B | fields user_id]

What is the alternate way to do this?

Tags (1)
0 Karma


Try this

event=A OR event=B
| stats count(eval(event="A")) as ACount count(eval(event="B")) as Bcount by user_id
| where ACount >= 1 AND BCount < 1

I realize that you are being abstract in your question, so my answer may not have enough details for you. Follow up with more details about event A and event B, if you want a more detailed answer...


@Iguinn, the answer looks promising. Just to have some more clarity, the events are something like this:
Event A = a user registration event (usually happens only once per user)
Event B = a user doing a payment on our application (could happen many times for a user or never at all).

So what I'm looking at is the list of users who have registered but have not yet done even a single payment. Hope this clarifies.


0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Hi Splunky people! We are excited to share the newest updates in Splunk Enterprise 9.3!Admins and Analyst can ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...