I had to add the Columname but then it worked, thanks! ... | dedup username | lookup test.csv username OUTPUT username AS foundInLookup | where isnull(foundInLookup) | table username ... View more

Yes I copied your Query. Both earliest=-24h host="*" sudo:session | rex "pam_unix(sudo:session): session opened for user root by (?[[:alnum:]_.]+)" | dedup user | table user earliest=-24h host="*" sudo:session | rex "pam_unix(sudo:session): session opened for user root by (?[[:alnum:]_.]+)" | eval username=upper(username) | stats count by username | append [| inputlookup test.csv | eval count=0, username=upper(username) | fields username count] | stats sum(count) AS Total by username Both shows the same Users, your shows the ammont of Logins (nice the stats count command), but the inputlookup / append commands seems to do nothing. Thanks ... View more

hey, thats for the quick comment. The test.csv contains a List of "OK" Users, I want to filter all Users that are not in that List. ... View more