Hi, Brand new to splunk here. I've been using it about 1 month. I have a lookup file, all_identities_prod.csv, that has a single column of identities (these look like email addresses) and the column name is 'identity'. What I've been trying to do is to compare the identities in the file with the result of a 30 day search to find identities that are in the lookup file but not in the search results. I've tried this many different ways. Maybe using a lookup file for this isn't the best idea. I don't know. Here's an example of what I've been trying. A subsearch seemed like the best idea. | inputlookup all_identities_prod.csv where NOT [search index=sec ab_id=cvo host=xxx-xxxx* identity="*" | dedup identity] | table identity I have to obfuscate the host name understandably. What I get back from this is the full list of the identities in the lookup file. I think the comparison function is where I'm lost. Any ideas? Maybe a better way of doing this altogether? Thanks in advance.
... View more
