splunk search query

[kajalchopade071]

if i have employees list .for each employee there are two status logged in and logged out, i need to find out the each users last status and if user last status is logged out i need to count how many employees get logged out

[ITWhisperer · Accepted solution]

| stats last(status) as status by user
| stats count(eval(status="logged out")) as logged_out_users