How to search a list of users who have tried to log in often or never logged in?

[vinodsinha]

Hi,

Is there any search to get a list of users who have tried to log in often or never logged in?

Thanks,

V

[chimell]

hi
try this

|set intersect[|rest /services/authentication/users|fields username][search NOT[ search index=_internal (sourcetype=splunk_web_access OR sourcetype=splunkd_access) | fields username ]]

[skoelpin]

I would suggest creating a field for users who logged in then create another field for users who logged out then do a ...| stats count by

To make the fields you will need to find a pattern then write a regular expression to capture this.. Post some a sample and I'll help write your regular expression

[vinodsinha]

similar like this query but without csv option:-

| inputcsv allusers.csv | search NOT [ search index=_internal (sourcetype=splunk_web_access OR sourcetype=splunkd_access) | fields user | dedup user ]

[skoelpin]

I'm looking for the data sample (Also known as events) which are returned when you run a query. It's impossible to create a regular expression without seeing the patterns in the data sample..

An example would be this

2/19/2016 12:01:00 - User gollam logged in 
2/19/2016 12:34:01 - User gollam logged out 

[vinodsinha]

give me any simple query.

[vinodsinha]

can you give me regular exp to run the query?

[vinodsinha]

something like this :-
index=_internal sourcetype=splunk_web_access | table user | dedup user

[skoelpin]

If you provide a data sample..