https://community.splunk.com/t5/Security/disabled-user-activity/m-p/163820#M4859 <P>Maybe you can use <CODE>index=_* user=* action="login attempt"</CODE>, and from there narrow down what you want with inactive or disabled user accounts. There are other values in action that could benefit what you want. Hope this helps.</P> Wed, 14 May 2014 14:40:16 GMT ben_leung 2014-05-14T14:40:16Z https://community.splunk.com/t5/Security/disabled-user-activity/m-p/163819#M4858 <P>Hello</P> <P>I'm looking for suggestions on a rule for : showing activity from a disabled user account.</P> <P>The following rule is what i have created, let me know if you think it can be tweaked or other any other query which you think does the job best.</P> <P>signature="Account is currently disabled" Workstation_Name!=XXXXXXX | table _time,user,signature,Workstation_Name,EventCode</P> <P>Regards<BR /> Arun</P> Mon, 28 Sep 2020 16:36:43 GMT https://community.splunk.com/t5/Security/disabled-user-activity/m-p/163819#M4858 108246 2020-09-28T16:36:43Z https://community.splunk.com/t5/Security/disabled-user-activity/m-p/163820#M4859 <P>Maybe you can use <CODE>index=_* user=* action="login attempt"</CODE>, and from there narrow down what you want with inactive or disabled user accounts. There are other values in action that could benefit what you want. Hope this helps.</P> Wed, 14 May 2014 14:40:16 GMT https://community.splunk.com/t5/Security/disabled-user-activity/m-p/163820#M4859 ben_leung 2014-05-14T14:40:16Z https://community.splunk.com/t5/Security/disabled-user-activity/m-p/163821#M4860 <P>Thanks Ben</P> Wed, 14 May 2014 15:39:38 GMT https://community.splunk.com/t5/Security/disabled-user-activity/m-p/163821#M4860 108246 2014-05-14T15:39:38Z