I have one search, for one event type, and a second search for a second event type. one is 'user login' and the other is 'user logout', right? Ideally in the search i am trying to create, the result set would be all of the users that have logged in, and that have not logged out.
I tried to use diff, but I don't know if that function is the best to use for this?
I'm still pretty new to Splunk, so please take a look.
My search looks like this:
this seems to give me all of the users that have logged in, and logged out. I'm looking for those that have logged in, and that have NOT logged out. any ideas?
transaction would be better suited for your scenario.
You could do something like
eventtype1 OR eventtype2 | transaction user | search eventtype1 AND NOT eventtype2