topic Search for inactive Splunk users in Security

Search for inactive Splunk users

Ellen — Tue, 23 Feb 2010 07:21:55 GMT

Is there a search for finding Splunk instance users who have not logged in for X amount of time eg. not logged in for the last 6 months? audit.log contains information on users last login attempt that succeeded. Would a look up setup be the approach?

Re: Search for inactive Splunk users

V_at_Splunk — Tue, 23 Feb 2010 10:23:30 GMT

You've pretty much answered your own question. Search for source=audit.log endmonthsago=6, and then | DEDUP user.

Splunk makes it easy! 8)

Re: Search for inactive Splunk users

gkanapathy — Tue, 23 Feb 2010 12:30:40 GMT

Obviously it's easy to find who has logged in within some past period of time. To find the complement of this, you have to know the full set, i.e., you need a list of all possible users who might have logged in. You can get this either from some canonical external source, or you could generate it by running over an even longer period:

 | inputlookup allusers | search NOT [ index=_audit action="login attempt" info="succeeded" earliest=-6mon | dedup user | fields user ]

 index=_audit action="login attempt" info="succeeded" earliest=-18mon latest=-6mon NOT [ index=_audit action="login attempt" info="succeeded" earliest=-6mon | dedup user | fields user ]

You could also generate the lookup on an ongoing basis with a scheduled search:

 index=_audit action="login attempt" info="succeeded" | dedup user | fields user | inputlookup append=t allusers | dedup user | outputlookup allusers

You would run this once over the long past to generate the initial table, then run it every (say) 24 hours over the past 24 hours to keep it up-to-date.

Re: Search for inactive Splunk users

V_at_Splunk — Fri, 05 Oct 2012 06:08:30 GMT

And anonymous downvoters make one loath to answer questions.