Splunk Search

How to identify users (UID) that use program A, but have never used program B?

Cox_JoshS
Explorer

I've got users using 2 apps that I'm pulling from, and I'm looking at login reports. Given that the users have unique IDs (UID) and unique app names (AppName), I want to figure out which unique users are using app A but NOT using app B. They can be using both, and I want to see which users have never used app B.

Is this possible through Splunk, or do I need to print them to a CSV and go from there?

Thanks for any help!

Tags (3)
1 Solution

musskopf
Builder

Hello,

Try a simple sub-search to exclude users:

index=my_index AND AppName="A" AND NOT
[
search index=my_index AppName="B" | dedup UID | fields UID
]
| dedup UID | table UID

The sub-search will basically list every unique UID that used App B, so we get the results and exclude from the users using app A. Now, if you have a user that never used App A neither App B, it won't show... if that might be a problem you need to use another source, list a list of UIDs instead of start with users using App A. Hope it all makes sense for you.

Cheers,

View solution in original post

musskopf
Builder

Hello,

Try a simple sub-search to exclude users:

index=my_index AND AppName="A" AND NOT
[
search index=my_index AppName="B" | dedup UID | fields UID
]
| dedup UID | table UID

The sub-search will basically list every unique UID that used App B, so we get the results and exclude from the users using app A. Now, if you have a user that never used App A neither App B, it won't show... if that might be a problem you need to use another source, list a list of UIDs instead of start with users using App A. Hope it all makes sense for you.

Cheers,

Cox_JoshS
Explorer

Yep, this has it for me. Thanks again!

0 Karma

musskopf
Builder

Yeah, you got it!

0 Karma

Cox_JoshS
Explorer

Thanks Musskopf!

So, let's see if I understand correctly -

--

index=my_index AND AppName="A" -- finding the users that use app "A"

[ search index=my_index AppName="B" | dedup UID | fields UID ] -- find all users using app "B", remove duplicates, strip all other fields

--

index=my_index AND AppName="A" AND NOT [ search index=my_index AppName="B" | dedup UID | fields UID ]

This combination I'm a little confused about, but if I'm correct this is saying 'if a given item is in the app "A" group, AND NOT in the app "B" group?

--

Then you take all of it, strip the duplicates, and make a table.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...