I have currently a lookup table that consists of Account_Name and Host. This was created from Windows Event 4624 (An Account was successfully logged on) from a search parameter of the last 30 days. I am wanting to use the lookup table to filter the Account_Name and Hosts, and display in the new query the differences that the new search brings. For example,
New Logons Data:
So the new results should provide me with:
So far my query is as follow:
index=main EventCode=4624 NOT [ | inputlookup lookuptable.csv ] | Table Account_Name Host
This is how I set up lookup tables with one field for filtering, but trying to filter from two fields has got me stuck.
Thanks in advance for any help.
... View more