Hi, I have deployed splunk to log data of users who are logging onto servers (unix and windows). I want to create a report that shows users who are not permitted to log onto those servers. I have been given a list of users which are permitted to log on so wanted to create a search which shows user logging on except the permitted users. I am trying to use the following: | stats count by User Please can someone advise what commands to use to included the list of permitted users i have and to exempt them from the search result? Regards, Chetan ... View more