Comparing the result of a search to lookup values is a very commonly used practice and you describe it perfectly.
The way I phrased it is actually a clue as to how you perform this.
You have a lookup table with valid hosts and users. (fields host, user)
You have a search that retrieves successful logins and the hosts.
To filter the search to show only those successful logins that occur on hosts NOT in your CSV you do this:
yourSearchwith_host NOT [ inputlookup yourlookup |fields host ]
so for instance you might say something like this:
index=blah sourcetype=blah_foo host=* login_status=success NOT [inputlookup legit_user_host.csv | fields host]
To really see what's going on, you'll want to look at the job inspector after it runs.
to make sense of this, you can run each part of the search independently and imagine the 'venn diagram' the "NOT" creates.
run index=blah sourcetype=blah_foo host=* login_status=success (any search that gives a list of the successful logins)
then you can independently run |inputlookup legit_user_host.csv|fields host run it all together and Splunk will give you the results showing when the data in splunk does NOT match the lookup list.
If you run the same and remove the NOT you get the list that DOES match...
With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
