topic search user check in Splunk Search

search user check

gitingua — Wed, 27 Oct 2021 01:07:40 GMT

It is necessary to check if the user is in the index in this file or not. If not, then add to the file, if it is in the file, then nothing happens

file.csv

username	info1	info2
john	abcd	qwer

index = IndexName

username	info1	info2
Aram	ghjk	qweiq

Condition, if the user is not found in the file, then write it to the file

output

username	info1	info2
john	abcd	qwer
Aram	ghjk	qweiq

Re: search user check

ITWhisperer — Wed, 27 Oct 2021 08:37:53 GMT

Try something like this

Re: search user check

gitingua — Wed, 27 Oct 2021 09:59:52 GMT

@ITWhisperer

can it be done through "where"?

Re: search user check

ITWhisperer — Wed, 27 Oct 2021 10:02:10 GMT

Can what be done through where?

Re: search user check

gitingua — Wed, 27 Oct 2021 10:15:02 GMT

@ITWhisperer

I have a check where two parameters are compared via "where"

example | where id != id_old

there are already users with ID in the file, and after verification new IDs are added. But it happens that a new user appears in the index.

And it turns out if "| where id != id_old" it does not pass. And I need to add a condition,if the check did not work "| where id != id_old", then check whether such a user exists at all in the file

Re: search user check

gitingua — Wed, 27 Oct 2021 11:31:55 GMT

example
| where id != id_old or not match(username)

is it possible to write something similar

@ITWhisperer