Username status
User1 login
User2 login
User3 login
User1 logout
User1 login
User1 logout
Now for login user there are 2 count
And for logout user there are 1 count
If i have logs Like above i mentioned .
Can you please help me to get the ans which i mentioned above as per last status of users.
Please be more specific about desired output.
Do you want the last "state" the user is in? (either logged in or logged out)
<your search>
| stats last(status) as status by Username
And if you want to just count how many users are logged in or out, you might simply add
| stats count by status
at the end.
Please be more specific about desired output.
Do you want the last "state" the user is in? (either logged in or logged out)
<your search>
| stats last(status) as status by Username
And if you want to just count how many users are logged in or out, you might simply add
| stats count by status
at the end.
Hi @kajalchopade071,
let me understand, you want to understand if there's a login without logout, is this correct?
If this is your need you have two choices:
using transaction, you could use something like this:
index=your_index
| transaction Username startswith=status=login endswith=status=logout keepevicted=true
| eval Status=if(closed_txn=0,"Login and Logout","Only Login")
| table Username Status duration
using stats it's difficoult to calculat duration when one Username can have more logins; anyway, you could use:
index=your_index
| stats dc(status) AS dc_status count(eval(status="Login")) AS logins count(eval(status="Logout")) AS logouts earliest(_time) AS earliest latest(_time) AS latest BY Username
| eval Status=if(dc_status=1 OR logins>logouts,"Only Login","Login and Logout", duration=latest-earliest
| table Username Status duration
Ciao.
Giuseppe
As per the users last status i need to count the login users and logout users
We need to find out the count for login user and logout user. As per the user last status like login OR logout. If the user last status is logout it counts in logout user. If user last status is login it Will be count in login users. In above question i mentioned some ex of logs in that user1 last status is logout it needs to count in logout user.
Index = your index l dedup Username | stats count by Username
Please try this..