I have a search that returns activity summary by email address. I also have a ksv with KNOWN users. How do I list those users that have no activity in the search?

[MwayneSmith]

someone suggested a join, but as a newbie...... Don't know how to do this. I believe I would need two searches, 1 being the user activity, 2 being the list of KNOWN users from the ksv. I can do both of those, but how to see the users without activity?

[MuS]

Hi MwayneSmith,

a very simple approach is to use the lookup (assuming the ksv file is a lookup file?) and search for anything that is NOT in an index:

| inputlookup file.csv | search NOT [search your search to get email activity | dedup user | fields user] 

an improved version of the search would search first the email activity events from an index, add the lookup information and count them:

your search to get email activity  
| stats count by user
| inputlookup append=true file.csv
| fillnull count

any result with count 0 are your users with no email activity.

Hope this helps ...

cheers, MuS