I have a search that returns information about usernames and their IP, machine name, etc.
I want to cross-reference a CSV lookup that has a list of usernames and then the search result would only show the results that match a username in the CSV.
This is what I have been working with so far, but it's not changing my query results.
index=dlp
[|inputlookup users.csv |fields username]
|table username, machine_name, ip_address
My CSV has 1 column labeled username with the fields containing the usernames.
That should work but may not scale well; try this:
index=dlp
| lookup users.csv username OUTPUT username AS MATCHED
| where isnotnull(MATCHED)
|table username, machine_name, ip_address
Try below query:-
index=dlp
| join username
[|inputlookup users.csv |fields username]
|table username, machine_name, ip_address
I am assuming your outer result must have field with username.