Hi,
I am trying to figure out how to use join to table the results from 2 searches.
sourcetype=AAD_MSGraph_UserData
AAD_OnPremSID AAD_Email AAD_UserType AAD_LastSignInDateTime AAD_LastNonInteractiveSignInDateTime AAD_LastPWChange
sourcetype=AD_UserData
AD_SID AD_UserPrincipalName AD_LastLogon
JOIN ON: AAD_OnPremSID AND AD_SID
TABLE RESULTS:
AAD_OnPremSID, AAD_Email, AAD_UserType, AAD_LastPWChange, AAD_LastSignInDateTime, AAD_LastNonInteractiveSignInDateTime, AD_LastLogon
Thanks!
Garry
... View more