Compare SSH users against authorized user list.

[nickabal]

I have a table that shows the usernames logging into to my various servers. I want to compare these results to a list of users I have specified in order to notice any users that should not be accessing certain systems.

Basically, I am looking to that verify usernames are in the "authorized user" array/list.

[martin_mueller]

That can be solved well with a lookup. For example, define a CSV file that contains two columns:

username,status
bob,okay
john,deleted

Define an automatic lookup that appends the status column to your search results based on the username. Then look for users that either have no value for status or have a value different from "okay".

You could also do lookups against a database, or join data from a second indexed source - what is best depends on your environment.