Splunk Search

Getting a list of active users usernames from a list of email addresses

agenco01
Engager

I have a CSV with multiple hundred email addresses and I am trying to run a report to determine which accounts are active, and their username within our domain. Is there a way to do this simply within Splunk?

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @agenco01,

let me understand: you have in a csv a list containing hundreds of email addresses and you want to know which of them are active, is it correct?

To do this, you need a data frow from an email sistem or a front end web server used by your email system.

Then you have to load your csv in a lookup and thes perform a search on your data, like this:

(hypothesis: index is called "email", csv file is called "email.csv", email field in email index is called "sender", email field in csv is called "email")

 

index=email
| eval sender=lower(sender)
| stats count BY sender
| append [| inputlookup email.csv | eval sender=lower(email), count=0 | fields sender count) ]
| stats sum(count) AS total BY sender
| eval stats=if(total=0,"Inactive","Active")
| sort sender
| table sender status

 

Ciao.

Giuseppe

View solution in original post

agenco01
Engager

Thanks for the help!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @agenco01,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

gcusello
SplunkTrust
SplunkTrust

Hi @agenco01,

let me understand: you have in a csv a list containing hundreds of email addresses and you want to know which of them are active, is it correct?

To do this, you need a data frow from an email sistem or a front end web server used by your email system.

Then you have to load your csv in a lookup and thes perform a search on your data, like this:

(hypothesis: index is called "email", csv file is called "email.csv", email field in email index is called "sender", email field in csv is called "email")

 

index=email
| eval sender=lower(sender)
| stats count BY sender
| append [| inputlookup email.csv | eval sender=lower(email), count=0 | fields sender count) ]
| stats sum(count) AS total BY sender
| eval stats=if(total=0,"Inactive","Active")
| sort sender
| table sender status

 

Ciao.

Giuseppe

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!