Compare items in lookup tables against auth logs

[th3_ugm4n]

Hi all! Pretty new to splunk so just seeing if this is even possible.

I have 2 lookups I have created, one that is users who are in our privileged access AD group (admins) and the other that is machines that are in the same group.

What I am trying to do is see who from the USER lookup has logged into which machine in the MACHINE lookup, by using the auth logs that are pumped into splunk.

I am trying the search below but I don't seem to be getting anywhere with it

index=auth EventCodeDescription="An account was successfully logged on" [|inputlookup users.csv][| inputlookup machines.csv]

I've also tried with the below but also no luck

index=auth EventCodeDescription="An account was successfully logged on" user=inputlookup users.csv src=inputlookup machines.csv

Any help from the community would be great!

[ITWhisperer]

DO the field names in the .csv's match the field names returned by the search e.g. if the search returns username and the csv lookup returns userid, you would need to rename the field in the inputlookup subsearch so that it matches.