How to identify users (UID) that use program A, but have never used program B?

[Cox_JoshS]

I've got users using 2 apps that I'm pulling from, and I'm looking at login reports. Given that the users have unique IDs (UID) and unique app names (AppName), I want to figure out which unique users are using app A but NOT using app B. They can be using both, and I want to see which users have never used app B.

Is this possible through Splunk, or do I need to print them to a CSV and go from there?

Thanks for any help!

[musskopf · Accepted solution]

Hello,

Try a simple sub-search to exclude users:

index=my_index AND AppName="A" AND NOT
[
search index=my_index AppName="B" | dedup UID | fields UID
]
| dedup UID | table UID

The sub-search will basically list every unique UID that used App B, so we get the results and exclude from the users using app A. Now, if you have a user that never used App A neither App B, it won't show... if that might be a problem you need to use another source, list a list of UIDs instead of start with users using App A. Hope it all makes sense for you.

Cheers,

[Cox_JoshS]

Yep, this has it for me. Thanks again!

[musskopf]

Yeah, you got it!

[Cox_JoshS]

Thanks Musskopf!

So, let's see if I understand correctly -

--

index=my_index AND AppName="A" -- finding the users that use app "A"

[ search index=my_index AppName="B" | dedup UID | fields UID ] -- find all users using app "B", remove duplicates, strip all other fields

--

index=my_index AND AppName="A" AND NOT [ search index=my_index AppName="B" | dedup UID | fields UID ]

This combination I'm a little confused about, but if I'm correct this is saying 'if a given item is in the app "A" group, AND NOT in the app "B" group?

--

Then you take all of it, strip the duplicates, and make a table.