These doubts are variations on the same theme as are the solutions.
One more doubt, i got Now last logout name of employee ,but supposed after some time he logged in again now i need to remove this user from my logout list. Can you please help me.
index=foo (status=logout OR status=logon)
```Find the most recent login/logout event for each employee```
| dedup name
```Keep only the logouts. All others are still logged on.```
| where status=logout
Supposed i have employees data status Like login logout. I need to calculate the how many employee logged in and logged out.
index=foo (status=logon OR status=logout)
| stats count by status
3 employees login and from that 3 employee One log out. Now I need to count in logout list. Suppose again the same employee login i need to push it into login list and remove from logout list likewise
index=foo (status=logon OR status=logout)
```Show who is logged in and who is logged out```
| stats values(name) as names by status
---
If this reply helps you, Karma would be appreciated.
