How to run an index to generate events through an input lookup table?

[charlottecl]

Hi all, 

I wish to generate login times for a list of users which are specified in a lookup table titled user_list.csv. The column header of the list of users in this list is called "IDENTITY".

Currently, I have an index that on its own without inserting the lookup table, already has a field called "Identity". This index itself gives me any users' login times within the specified timeframe as long as I specify Identity="*". Without specifying Identity="*" or any other user's names, the events will not populate.

What I am trying to do is to input a specified list of users and be able to check their login times. However when I use the following search query, I end up getting 0 events:

index=logintime 

[|inputlookup user_list.csv

|fields IDENTITY

|format]

IDENTITY="*"

| table _time, eventType, ComputerName, IDENTITY

I have already checked that the lookup table is within the same app. Please help, thank you.

[richgalloway · Accepted solution]

Field names are case-sensitive.  The 'IDENTITY="*"' line is not needed because the subsearch will produce a list of IDENTITY values to locate.

index=logintime [|inputlookup user_list.csv
  | rename IDENTITY as Identity
  | fields Identity
  | format ]
| table _time, eventType, ComputerName, Identity

[charlottecl]

Thanks a lot! I tried this and it works. Turns out that I have to rename first before adding it as a field.