topic Re: Pull list of user accounts with last logon in Splunk Search

Pull list of user accounts with last logon

ctaylor3819 — Tue, 28 Sep 2021 19:54:52 GMT

How do I pull together a chart of all our user accounts, with the last time that user logged in?

I currently have:

eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681) | stats max(Time) by Logon_Account

I am getting the time but also need to display the date. I am also getting a lot of service accounts, is there an easy way to filter those out?

Re: Pull list of user accounts with last logon

ashvinpandey — Tue, 28 Sep 2021 20:22:26 GMT

@ctaylor3819 Try using the below query for the date and time:

eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681) | stats latest(_time) as Latest_Time by Logon_Account | convert ctime(Latest_Time)

In order to filter the users you can you a lookup file containing the list of users you want to get or the list of genuine users and use a lookup command to get only those users.

Also, If this reply helps you, an upvote would be appreciated.