Splunk Search

How to match two sources and output anything that does not correlate or match up.

kgreat
Path Finder

Hi I have two csv files each listing a list of users and their status (Active or Disabled). I would like to correlate and match all Active users on email address and then output any users that don't match. The purpose of this exercise is to find any orphaned or unknown accounts within an application.

Source A (Lists All users from the directory and their status)
Field Names:
emailaddress (unique identifier)
User Status (with values either Active or Disabled)
First Name
Last Name

Source B (Lists all users found maintained in an application)
emailaddress (unique identifier)
First Name
Last Name

Tags (2)
0 Karma

chimell
Motivator

Hi kgreat
Try this search code

| set union [search SourceA   UserStatus="Active"|where isnull(emailaddress)  | fields firstName  lastName] [search SourceB  UserStatus="Active" |where isnull(emailaddress)  | fields firstName  lastName]

Tell me if it satisfy you

0 Karma

btt
Path Finder

Hi,
I'm not sure that i really understand your need but, in this query i first have all emailaddress in my two sources and then discard all those who are active.

sourceA | join emailaddress [search sourceB ] NOT [sourceA  Userstatus=Active |join [search sourceB Userstatus=Active] |fields emailaddress] |table emailaddress FirstName LastName
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...