I am trying to write a query in Splunk that will tell me if any user IDs in my CSV file were used to log into any machines that ARE NOT in my CSV file. I have a CSV file called "MLT_List.csv" with three fields. The second field contains the user IDs and is called "User_ID". The third field is called "Computers". So I want to search Splunk for any successful logins with the user IDs in the CSV that are not logging into any of the computers in the CSV. I don't know if I am being clear or not. Thanks in advance for any help!
... View more