https://community.splunk.com/t5/Reporting/Account-usage-by-OU/m-p/551231#M9073 <P>Hi,</P><P>&nbsp;</P><P>Basically I need to find out when some old service accounts were last used/if they have ever been used. We have 1000's and would like a report string that would report based on all accounts found in a particular OU. I have one for searching specific accounts but copy and pasting all the account names is very tedious.</P><P>&nbsp;</P><P>This is what I have for searching accounts:</P><P>&nbsp;</P><P>index=wineventlog source="WinEventLog:Security"<BR />Account_Name=redbox.service<BR />host!=DOMAIN, host!=DOMAIN, host!=DOMAIN, host!=DOMAIN* | stats count by Account_Name, host</P><P>I am very new to splunk so any suggestions would be much appreciated. If you know of a better way to do this then feel free to let me know!</P><P>&nbsp;</P> Tue, 11 May 2021 12:30:16 GMT Krillu 2021-05-11T12:30:16Z https://community.splunk.com/t5/Reporting/Account-usage-by-OU/m-p/551231#M9073 <P>Hi,</P><P>&nbsp;</P><P>Basically I need to find out when some old service accounts were last used/if they have ever been used. We have 1000's and would like a report string that would report based on all accounts found in a particular OU. I have one for searching specific accounts but copy and pasting all the account names is very tedious.</P><P>&nbsp;</P><P>This is what I have for searching accounts:</P><P>&nbsp;</P><P>index=wineventlog source="WinEventLog:Security"<BR />Account_Name=redbox.service<BR />host!=DOMAIN, host!=DOMAIN, host!=DOMAIN, host!=DOMAIN* | stats count by Account_Name, host</P><P>I am very new to splunk so any suggestions would be much appreciated. If you know of a better way to do this then feel free to let me know!</P><P>&nbsp;</P> Tue, 11 May 2021 12:30:16 GMT https://community.splunk.com/t5/Reporting/Account-usage-by-OU/m-p/551231#M9073 Krillu 2021-05-11T12:30:16Z