Search for inactive Splunk users

Obviously it's easy to find who has logged in within some past period of time. To find the complement of this, you have to know the full set, i.e., you need a list of all possible users who might have logged in. You can get this either from some canonical external source, or you could generate it by running over an even longer period:

 | inputlookup allusers | search NOT [ index=_audit action="login attempt" info="succeeded" earliest=-6mon | dedup user | fields user ]

or

 index=_audit action="login attempt" info="succeeded" earliest=-18mon latest=-6mon NOT [ index=_audit action="login attempt" info="succeeded" earliest=-6mon | dedup user | fields user ]

You could also generate the lookup on an ongoing basis with a scheduled search:

 index=_audit action="login attempt" info="succeeded" | dedup user | fields user | inputlookup append=t allusers | dedup user | outputlookup allusers

You would run this once over the long past to generate the initial table, then run it every (say) 24 hours over the past 24 hours to keep it up-to-date.