Splunk Search

How to match two sources and output anything that does not correlate or match up.

Path Finder

Hi I have two csv files each listing a list of users and their status (Active or Disabled). I would like to correlate and match all Active users on email address and then output any users that don't match. The purpose of this exercise is to find any orphaned or unknown accounts within an application.

Source A (Lists All users from the directory and their status)
Field Names:
emailaddress (unique identifier)
User Status (with values either Active or Disabled)
First Name
Last Name

Source B (Lists all users found maintained in an application)
emailaddress (unique identifier)
First Name
Last Name

Tags (2)
0 Karma


Hi kgreat
Try this search code

| set union [search SourceA   UserStatus="Active"|where isnull(emailaddress)  | fields firstName  lastName] [search SourceB  UserStatus="Active" |where isnull(emailaddress)  | fields firstName  lastName]

Tell me if it satisfy you

0 Karma

Path Finder

I'm not sure that i really understand your need but, in this query i first have all emailaddress in my two sources and then discard all those who are active.

sourceA | join emailaddress [search sourceB ] NOT [sourceA  Userstatus=Active |join [search sourceB Userstatus=Active] |fields emailaddress] |table emailaddress FirstName LastName
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...