Hi @ntalwar,
I'll prefer below steps to achieve this.
1.) Create CSV file which contains list of users who already logged into the server previously ( If you have this data in splunk you can fetch those data and generate lookup).
2.) Upload that csv in Splunk.
3.) Run you search to find users who logging into server and compare that against csv file which you have uploaded in splunk (Using lookup command)
4.) Filter users who are not in lookup file (Something like | where isnull(lookup_user) )
5.) Once you have result you can run this as scheduled search to send result over email and in same query I'll use outputlookup in last to update existing lookup file which contains logged in user details so in future when query will run it will not generate result against those newly logged in user.
I hope this helps.
Thanks,
Harshil
