Getting a list of active users usernames from a list of email addresses

[agenco01]

I have a CSV with multiple hundred email addresses and I am trying to run a report to determine which accounts are active, and their username within our domain. Is there a way to do this simply within Splunk?

[agenco01]

Thanks for the help!

[gcusello]

Hi @agenco01,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello · Accepted solution]

Hi @agenco01,

let me understand: you have in a csv a list containing hundreds of email addresses and you want to know which of them are active, is it correct?

To do this, you need a data frow from an email sistem or a front end web server used by your email system.

Then you have to load your csv in a lookup and thes perform a search on your data, like this:

(hypothesis: index is called "email", csv file is called "email.csv", email field in email index is called "sender", email field in csv is called "email")

index=email
| eval sender=lower(sender)
| stats count BY sender
| append [| inputlookup email.csv | eval sender=lower(email), count=0 | fields sender count) ]
| stats sum(count) AS total BY sender
| eval stats=if(total=0,"Inactive","Active")
| sort sender
| table sender status

Ciao.

Giuseppe