Best way to dump Azure UPNs into scheduled lookup.

[fdevera]

I'm trying to dump this info into a scheduled lookup but these are just azuread UPNs that are appearing in the logs for whatever search time it's set to. How do I efficiently get ALL UPNs that are in this rex format regardless of log time?

index=azuread
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| search GUID=*
| dedup initiatedBy.user.userPrincipalName
| table initiatedBy.user.userPrincipalName, GUID
| outputlookup zguids.csv

[tscroggins · Accepted solution]

@fdevera 

A typical recurring lookup generator would append to the existing lookup:

index=azuread
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| search GUID=*
| table initiatedBy.user.userPrincipalName, GUID
| inputlookup append=t zguids.csv
| dedup initiatedBy.user.userPrincipalName
| outputlookup zguids.csv

The initial lookup can be populated by executing the search manually over a sufficient range of time. Subsequent searches should be limited to the schedule window. I.e. For an hourly search, set earliest=-1h@h latest=@h. Be sure to account for input lag and adjust scheduling as needed.