I have a search that returns information about usernames and their IP, machine name, etc.
I want to cross-reference a CSV lookup that has a list of usernames and then the search result would only show the results that match a username in the CSV.
This is what I have been working with so far, but it's not changing my query results.
index=dlp
[|inputlookup users.csv |fields username]
|table username, machine_name, ip_address
My CSV has 1 column labeled username with the fields containing the usernames.
↧