topic Re: Windows Last Logon in Getting Data In

Windows Last Logon

Ed_Alias — Mon, 16 Jun 2014 08:41:04 GMT

Hi,

i'm trying to make a request to get the last logon for each users in my windows infrastructure;

i have a simple request for now :

host=* EventCode=4624

i can't find a time stamp for events, how do i get event time ?

a second need would be to only keep in report the last "time"

Thanks for comunity advises 😃

Re: Windows Last Logon

PPape — Mon, 16 Jun 2014 09:39:39 GMT

Maybe you should take a look on this:
https://apps.splunk.com/app/1448/

I think this App fits for you.

Re: Windows Last Logon

Ed_Alias — Mon, 16 Jun 2014 11:36:53 GMT

thanks i'll check that app 😃

but i still would like to have a request to do that

Re: Windows Last Logon

alterdego — Mon, 28 Sep 2020 16:51:45 GMT

This should give you something more along the lines of what you were looking for:
EventCode=4624 | dedup ComputerName | table ComputerName _time

Not exactly what you asked for but to get more useful results you might want to also examine the Account_Name, Security_ID and Logon_Type fields.

Re: Windows Last Logon

Ed_Alias — Mon, 16 Jun 2014 11:58:25 GMT

That seems to be what i'm looking for : )

what does the "_time" stands for ? it takes a timestamp of field ?

Re: Windows Last Logon

alterdego — Mon, 16 Jun 2014 12:03:02 GMT

The _time field is the internal time stamp that Splunk assigns to an event.
This should provide more insight:
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usedefaultfields
Good Luck!

Re: Windows Last Logon

Ed_Alias — Wed, 18 Jun 2014 08:17:21 GMT

hey, i'm almost getting the report as i want : )

when i extract as a CSV i only get _time field, here is my request :

EventCode=4624 sourcetype="WinEventLog:Security" NOT "Nom du compte "="*$" | dedup "Nom du compte " | table "Nom du compte " _time

Re: Windows Last Logon

alterdego — Wed, 18 Jun 2014 12:00:43 GMT

As I read it "Nom du compte " is being passed to the table command as a string and not a field.

If I wasn't getting the fields in the table I wanted I would try something like:
EventCode=4624 sourcetype="WinEventLog:Security" ComputerName!="*$" | dedup ComputerName | table *
which should create a table with all the fields. From that I would identify the columns I wanted to keep and use the filed values after the table command to create the final version.

Re: Windows Last Logon

Ed_Alias — Wed, 18 Jun 2014 13:50:20 GMT

i guess you are right i already red that splunk is not very friendly to non english logs ... i 'll try your workaround