How to match two sources and output anything that does not correlate or match up.

[kgreat]

Hi I have two csv files each listing a list of users and their status (Active or Disabled). I would like to correlate and match all Active users on email address and then output any users that don't match. The purpose of this exercise is to find any orphaned or unknown accounts within an application.

Source A (Lists All users from the directory and their status)
Field Names:
emailaddress (unique identifier)
User Status (with values either Active or Disabled)
First Name
Last Name

Source B (Lists all users found maintained in an application)
emailaddress (unique identifier)
First Name
Last Name

[chimell]

Hi kgreat
Try this search code

| set union [search SourceA   UserStatus="Active"|where isnull(emailaddress)  | fields firstName  lastName] [search SourceB  UserStatus="Active" |where isnull(emailaddress)  | fields firstName  lastName]

Tell me if it satisfy you

[btt]

Hi,
I'm not sure that i really understand your need but, in this query i first have all emailaddress in my two sources and then discard all those who are active.

sourceA | join emailaddress [search sourceB ] NOT [sourceA  Userstatus=Active |join [search sourceB Userstatus=Active] |fields emailaddress] |table emailaddress FirstName LastName