topic Getting a list of active users usernames from a list of email addresses in Splunk Search

Getting a list of active users usernames from a list of email addresses

agenco01 — Thu, 13 May 2021 19:38:59 GMT

I have a CSV with multiple hundred email addresses and I am trying to run a report to determine which accounts are active, and their username within our domain. Is there a way to do this simply within Splunk?

Re: Getting a list of active users usernames from a list of email addresses

gcusello — Fri, 14 May 2021 06:03:25 GMT

Hi @agenco01,

let me understand: you have in a csv a list containing hundreds of email addresses and you want to know which of them are active, is it correct?

To do this, you need a data frow from an email sistem or a front end web server used by your email system.

Then you have to load your csv in a lookup and thes perform a search on your data, like this:

(hypothesis: index is called "email", csv file is called "email.csv", email field in email index is called "sender", email field in csv is called "email")

Ciao.

Giuseppe

Re: Getting a list of active users usernames from a list of email addresses

agenco01 — Mon, 17 May 2021 13:08:11 GMT

Thanks for the help!

Re: Getting a list of active users usernames from a list of email addresses

gcusello — Mon, 17 May 2021 13:10:46 GMT

Hi @agenco01,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉