Splunk Search

I have a search that returns activity summary by email address. I also have a ksv with KNOWN users. How do I list those users that have no activity in the search?


someone suggested a join, but as a newbie...... Don't know how to do this. I believe I would need two searches, 1 being the user activity, 2 being the list of KNOWN users from the ksv. I can do both of those, but how to see the users without activity?

Tags (2)
0 Karma


Hi MwayneSmith,

a very simple approach is to use the lookup (assuming the ksv file is a lookup file?) and search for anything that is NOT in an index:

| inputlookup file.csv | search NOT [search your search to get email activity | dedup user | fields user] 

an improved version of the search would search first the email activity events from an index, add the lookup information and count them:

your search to get email activity  
| stats count by user
| inputlookup append=true file.csv
| fillnull count

any result with count 0 are your users with no email activity.

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...