Getting Data In

Compare SSH users against authorized user list.

nickabal
New Member

I have a table that shows the usernames logging into to my various servers. I want to compare these results to a list of users I have specified in order to notice any users that should not be accessing certain systems.

Basically, I am looking to that verify usernames are in the "authorized user" array/list.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That can be solved well with a lookup. For example, define a CSV file that contains two columns:

username,status
bob,okay
john,deleted

Define an automatic lookup that appends the status column to your search results based on the username. Then look for users that either have no value for status or have a value different from "okay".

You could also do lookups against a database, or join data from a second indexed source - what is best depends on your environment.

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.