Hi I have two csv files each listing a list of users and their status (Active or Disabled). I would like to correlate and match all Active users on email address and then output any users that don't match. The purpose of this exercise is to find any orphaned or unknown accounts within an application.
Source A (Lists All users from the directory and their status)
Field Names:
emailaddress (unique identifier)
User Status (with values either Active or Disabled)
First Name
Last Name
Source B (Lists all users found maintained in an application)
emailaddress (unique identifier)
First Name
Last Name
Hi kgreat
Try this search code
| set union [search SourceA UserStatus="Active"|where isnull(emailaddress) | fields firstName lastName] [search SourceB UserStatus="Active" |where isnull(emailaddress) | fields firstName lastName]
Tell me if it satisfy you
Hi,
I'm not sure that i really understand your need but, in this query i first have all emailaddress in my two sources and then discard all those who are active.
sourceA | join emailaddress [search sourceB ] NOT [sourceA Userstatus=Active |join [search sourceB Userstatus=Active] |fields emailaddress] |table emailaddress FirstName LastName