Splunk Search

Column comparison for authentication

qazwsxedc994
Explorer

Hi,

I created a search which provides me with the usernames of all user which have logged on, i have another column right now which is from a database containing all the authenticated usernames. I want to check that all usernames in the first column are in the database.

I tried using:
eval Results=if(match(Loggedin_user,username), "yes","no"

but doesnt work. I need a way to loop through the Loggedin_user column verifying that the username is in the username column.

Any suggestion on how to do this?

0 Karma

diogofgm
SplunkTrust
SplunkTrust

This might not be the best solution but...
You can | append the usernames from the db to the result of the search. Instead of using 2 columns you'll end up with 1 column with every username. After that just use:

|stats count by username

Then you just use search to filter results:
For users on both places:

 ...| search count =2

For users only in one place:

 ...| search count < 2

If you want to know where they are you could even use values(source) in the stats command

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...