Splunk Search

Help with diff or eval?

tmarlette
Motivator

I have one search, for one event type, and a second search for a second event type. one is 'user login' and the other is 'user logout', right? Ideally in the search i am trying to create, the result set would be all of the users that have logged in, and that have not logged out.

I tried to use diff, but I don't know if that function is the best to use for this?

I'm still pretty new to Splunk, so please take a look.

My search looks like this:
| join user(subsearch for eventtype 2) | dedup user | table _time,host,user,ip

this seems to give me all of the users that have logged in, and logged out. I'm looking for those that have logged in, and that have NOT logged out. any ideas?

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Perhaps transaction would be better suited for your scenario.

You could do something like

eventtype1 OR eventtype2 | transaction user | search eventtype1 AND NOT eventtype2

View solution in original post

Ayn
Legend

Perhaps transaction would be better suited for your scenario.

You could do something like

eventtype1 OR eventtype2 | transaction user | search eventtype1 AND NOT eventtype2

tmarlette
Motivator

This did work with some more monkeying! Thank you!

0 Karma

tmarlette
Motivator

I believe it's closer, I think I will still have to fiddle with this to get it right.

Thank you so much! I'm sure ill be back. 😃

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...