Splunk query

[kajalchopade071]

Username status 

User1       login

User2       login

User3       login 

User1     logout 

User1     login

User1    logout 

Now for login user there are 2 count 

And for logout user there are 1 count 

If i have logs Like above i mentioned .

Can you please help me to get the ans which i mentioned  above as per last status of users. 

[PickleRick · Accepted solution]

Please be more specific about desired output.

Do you want the last "state" the user is in? (either logged in or logged out)

<your search>
| stats last(status) as status by Username

 And if you want to just count how many users are logged in or out, you might simply add

| stats count by status

at the end.

[gcusello]

Hi @kajalchopade071,

let me understand, you want to understand if there's a login without logout, is this correct?

If this is your need you have two choices:

• using transaction command: it's slower but easier to use,
• using stats command: it's faster but less easy to use and there could be one strange condition.

using transaction, you could use something like this:

index=your_index
| transaction Username startswith=status=login endswith=status=logout keepevicted=true
| eval Status=if(closed_txn=0,"Login and Logout","Only Login")
| table Username Status duration

using stats it's difficoult to calculat duration when one Username can have more logins; anyway, you could use:

index=your_index
| stats dc(status) AS dc_status count(eval(status="Login")) AS logins count(eval(status="Logout")) AS logouts earliest(_time) AS earliest latest(_time) AS latest BY Username
| eval Status=if(dc_status=1 OR logins>logouts,"Only Login","Login and Logout", duration=latest-earliest
| table Username Status duration

 Ciao.

Giuseppe

[kajalchopade071]

As per the users last status i need to count the login users and logout users 

[kajalchopade071]

We need to find out the count for login user and logout user. As per the user last status like login OR logout. If the user last status is logout it counts in logout user. If user last status is login it Will be count in login users. In above question i mentioned some ex of  logs in that user1 last status is logout it needs to count in logout user. 

[SinghK]

Index = your index l dedup Username | stats count by Username 

Please try this..