How to compare IP and Username in Logs with Lookup File

[gozdeyildiz]

Hello,

I am trying to compare IP,user field in a log and then compare it with a lookup file(having only IP and username field). What I want to try is to find the firewall logs having same IP with the lookup file but different username. Could you help me? Let's assume the fields as below.

Username in log: assigned_user
IP in the log: assigned_ip
username in lookup file: username

Bests
IP in the lookup file: src_ip

[gcusello]

Hi gozdeyildiz,
try something like this:

index=my_index assigned_user=*
| lookup my_lookup.csv src_ip AS assigned_ip OUTPUT username
| search  NOT assigned_user=username
| dedup assigned_ip assigned_user
| table assigned_ip assigned_user username

Ciao.
Giuseppe