topic How to search in active directory for servers connected in the last 14 days? in Splunk Search

How to search in active directory for servers connected in the last 14 days?

numeroinconnu12 — Thu, 19 Jan 2023 21:18:35 GMT

Hello and happy new year to all,

As the title says I would like to have the list of servers that have connected over the last 14 days (Lastlogon)... I have tried several methods but nothing works, here is my query :

index=msad SamAccountName=*$ VersionOS="Windows Server*"
| eval llt=strptime(LastLogon,"%d/%m/%Y %H:%M:%S")
| eval LastLogon2=strftime(llt, "%d/%m/%Y %H:%M:%S")
| rex field=SamAccountName mode=sed "s/\$//g"
| table Domain,SamAccountName,VersionOS,LastLogon2

Thanks

Re: How to search in active directory for servers connected in the last 14 days?

richgalloway — Thu, 19 Jan 2023 21:37:21 GMT

You created the llt field, but didn't do anything with it. Use the relative_time function to see how old llt is.

index=msad SamAccountName=*$ VersionOS="Windows Server*" | eval llt=strptime(LastLogon,"%d/%m/%Y %H:%M:%S") | where llt > relative_time(now(), "-14d") | rex field=SamAccountName mode=sed "s/\$//g" | table Domain,SamAccountName,VersionOS,LastLogon

Re: How to search in active directory for servers connected in the last 14 days?

numeroinconnu12 — Fri, 20 Jan 2023 08:50:38 GMT

thank you very much, it's works@richgalloway