Getting Data In

Compare SSH users against authorized user list.

New Member

I have a table that shows the usernames logging into to my various servers. I want to compare these results to a list of users I have specified in order to notice any users that should not be accessing certain systems.

Basically, I am looking to that verify usernames are in the "authorized user" array/list.

0 Karma

SplunkTrust
SplunkTrust

That can be solved well with a lookup. For example, define a CSV file that contains two columns:

username,status
bob,okay
john,deleted

Define an automatic lookup that appends the status column to your search results based on the username. Then look for users that either have no value for status or have a value different from "okay".

You could also do lookups against a database, or join data from a second indexed source - what is best depends on your environment.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!