Splunk Search

How to identify users (UID) that use program A, but have never used program B?

Explorer

I've got users using 2 apps that I'm pulling from, and I'm looking at login reports. Given that the users have unique IDs (UID) and unique app names (AppName), I want to figure out which unique users are using app A but NOT using app B. They can be using both, and I want to see which users have never used app B.

Is this possible through Splunk, or do I need to print them to a CSV and go from there?

Thanks for any help!

Tags (3)
1 Solution

Builder

Hello,

Try a simple sub-search to exclude users:

index=my_index AND AppName="A" AND NOT
[
search index=my_index AppName="B" | dedup UID | fields UID
]
| dedup UID | table UID

The sub-search will basically list every unique UID that used App B, so we get the results and exclude from the users using app A. Now, if you have a user that never used App A neither App B, it won't show... if that might be a problem you need to use another source, list a list of UIDs instead of start with users using App A. Hope it all makes sense for you.

Cheers,

View solution in original post

Builder

Hello,

Try a simple sub-search to exclude users:

index=my_index AND AppName="A" AND NOT
[
search index=my_index AppName="B" | dedup UID | fields UID
]
| dedup UID | table UID

The sub-search will basically list every unique UID that used App B, so we get the results and exclude from the users using app A. Now, if you have a user that never used App A neither App B, it won't show... if that might be a problem you need to use another source, list a list of UIDs instead of start with users using App A. Hope it all makes sense for you.

Cheers,

View solution in original post

Explorer

Yep, this has it for me. Thanks again!

0 Karma

Builder

Yeah, you got it!

0 Karma

Explorer

Thanks Musskopf!

So, let's see if I understand correctly -

--

index=my_index AND AppName="A" -- finding the users that use app "A"

[ search index=my_index AppName="B" | dedup UID | fields UID ] -- find all users using app "B", remove duplicates, strip all other fields

--

index=myindex AND AppName="A" AND NOT [ search index=myindex AppName="B" | dedup UID | fields UID ]

This combination I'm a little confused about, but if I'm correct this is saying 'if a given item is in the app "A" group, AND NOT in the app "B" group?

--

Then you take all of it, strip the duplicates, and make a table.

0 Karma