I'm trying to dump this info into a scheduled lookup but these are just azuread UPNs that are appearing in the logs for whatever search time it's set to. How do I efficiently get ALL UPNs that are in this rex format regardless of log time?
index=azuread
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| search GUID=*
| dedup initiatedBy.user.userPrincipalName
| table initiatedBy.user.userPrincipalName, GUID
| outputlookup zguids.csv
A typical recurring lookup generator would append to the existing lookup:
index=azuread
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| search GUID=*
| table initiatedBy.user.userPrincipalName, GUID
| inputlookup append=t zguids.csv
| dedup initiatedBy.user.userPrincipalName
| outputlookup zguids.csv
The initial lookup can be populated by executing the search manually over a sufficient range of time. Subsequent searches should be limited to the schedule window. I.e. For an hourly search, set earliest=-1h@h latest=@h. Be sure to account for input lag and adjust scheduling as needed.
A typical recurring lookup generator would append to the existing lookup:
index=azuread
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| search GUID=*
| table initiatedBy.user.userPrincipalName, GUID
| inputlookup append=t zguids.csv
| dedup initiatedBy.user.userPrincipalName
| outputlookup zguids.csv
The initial lookup can be populated by executing the search manually over a sufficient range of time. Subsequent searches should be limited to the schedule window. I.e. For an hourly search, set earliest=-1h@h latest=@h. Be sure to account for input lag and adjust scheduling as needed.