This is by no means perfect, but it has worked for me. Run this in search to generate you .csv lookup: | append [search index=okta sourcetype="OktaIM2:user" earliest=0| rename user AS identity, profile.firstName AS first, profile.lastName AS last, profile.email AS email, user_phone AS phone, user_managedBy AS managedBy, user_bunit AS bunit, user_work_city AS work_city, user_work_country AS work_country, activated AS startDate] | eval priority = "medium" | sort 0 - startDate | dedup identity | table identity,prefix,nick,first,last,suffix,email,phone,managedBy,priority,bunit,category,watchlist,startDate,endDate,work_city,work_country,work_lat,work_long | outputlookup corporate_identities.csv Schedule a search for the following: | inputlookup corporate_identities.csv | append [search index=okta sourcetype="OktaIM2:user" earliest=0| rename user AS identity, profile.firstName AS first, profile.lastName AS last, profile.email AS email, user_phone AS phone, user_managedBy AS managedBy, user_bunit AS bunit, user_work_city AS work_city, user_work_country AS work_country, activated AS startDate] | eval priority = "medium" | sort 0 - startDate | dedup identity | table identity,prefix,nick,first,last,suffix,email,phone,managedBy,priority,bunit,category,watchlist,startDate,endDate,work_city,work_country,work_lat,work_long | outputlookup corporate_identities.csv The improvement I'd like to see would be on timing of when identities are modified, or some attribute to know if the identity is active or not. Would need to play with dedup and earliest=0. Any suggestions/edits are welcomed! ... View more