List of users accessing activesync

[jennjoe1]

index=exchange sourcetype=uag trunk="activesync2010" user="*" *returns a list of active sync users in the last timeframe

I have a lookup table list of watched users

| lookup VIP_mail.csv

If the user in the VIP lookup table also has active usage logs than I want the logs for all users in the table

index=exchange sourcetype=uag trunk="activesync2010" user="*" | lookup VIP_mail.csv "User ID" as USERID | where user=USERID

the match should be true if user ID's match

[DalJeanis · Accepted solution]

Try this

index=exchange sourcetype=uag trunk="activesync2010" user="*" 
| lookup VIP_mail.csv "User ID" as user OUTPUT "User ID"  as USERID 
| where isnotnull(USERID)

[jennjoe1]

Perfect 🙂