testing for the occurrence of a user

[a212830]

Hi,

I need to check to see if a list of users (150+) have logged in recently. The data comes in via syslog, and I've been able to extract the usernames from the syslog. I created a lookup file that contains just the usernames. How can I validate that these people have logged in? I can run a search that extracts the syslog messages, but how do I validate it against the lookup table? Or am I going about this all wrong?

[HiroshiSatoh]

But what about such a feeling?

ex.
(USER_MST.CSV)
USER
USER_A
USER_B

USER_C
USER_D
USER_E

(search)
|inputlookup USER_MST.CSV|join type=outer USER [search index=*|stats count by USER]

(results)

USER count

USER_A 10
USER_B

USER_C 1
USER_D 5
USER_E