I am trying to build a search that takes an inputlookup file that has 2 columns; One is a list of usernames, the second is a list of FQDN's, and generates results when any of the users in the list are seen logging in to any computer other than the one adjacent to it in Column B (their assigned workstations).
For example: Inputlookupfile.csv Column A Column B Username A FQDN1 Username B FQDN2
With this example, my search needs to be able to compare column A with column B, and generate results if say, Username A logs into ANY OTHER computer other than FQDN1 (or even both FQDN1 and FQDN2, but preferably only the one in the adjacent cell).
If there is a simpler way to generate results of a user logging into a machine other than their own, I am all ears. Note: Some users have multiple computers, so I will also need to figure out what the best method is for factoring that in.
Generally you'd do like this (assuming your indexed data search has a field username and computer_name it them.)
index=foo sourcetpe=bar..your indexed data search | lookup inputlookupfile.csv "column A" as username OUTPUT "column B" as assigned_computer_name | where computer_name!=assigned_computer_name
The lookup command will match the username (from indexed data search) with "column A" (from lookup) and add assigned_computer_name (renamed column B from lookup) to search result as a new column. The where clause will just compare computer_name (from indexed data search) with assigned_computer_name to filter results where they don't match.
Thank you somesoni2,
I am in the process of testing this to see if it works. I am not getting errors anymore, but not getting any results either. I will run some test configs and see if I can get some results, and then return back to share what I came up with.
I am not requesting that someone builds a search for me, but am wanting to know if this idea can be accomplished or not. If comparing fields in a csv file is not possible, if anyone knows any other method that might work to accomplish this idea that would be very useful. I felt the need to clarify this since I may not have properly worded my request.