topic Re: Splunk search query for identifing the list of unauthorized user from the authorized users db lookup table in Splunk Search

Splunk search for identifying the list of unauthorized user from the authorized users db lookup table?

dbuddha2020 — Mon, 06 Mar 2023 14:26:36 GMT

We have a list of authorized user who have to specific Database and created a lookup table name "Authorized_list.csv". tried a search query for any unathorized user/s access db apart of that lookup table, need to be notified.

Re: Splunk search query for identifing the list of unauthorized user from the authorized users db lookup table

dbuddha2020 — Fri, 03 Mar 2023 16:32:03 GMT

Can someone please help me getting the search query.

Re: Splunk search query for identifing the list of unauthorized user from the authorized users db lookup table

aoverfield — Fri, 03 Mar 2023 16:49:36 GMT

Do you have any start to a search you could post?

In general, you could do something like:

"index=<db_index> users=* NOT [| inputlookup Authorized_list.csv | fields users] | stats count by users"

This is assuming "users" is a field in both your indexed data and a field in the CSV.