Hello all,
I am searching in Splunk for the last login date of a User and export it into a table:
... | eval date=strftime(_time,"%F")
| stats latest(date) by U
| table U, latest(date)
Now I have a lookup table (user_info.csv) containing ALL UserID from the system.
I would like to include all of them on the my search results, even those who never logged-in in the system. For example (PWMDN):
UserID Last login
JLSME 2019-02-21
KOEMN 2019-10-12
PWMDN Never (or 1900-01-01)
JDEMI 2019-09-11
Do you have any Idea how to do it?
Thank you very much
↧