topic Re: Splunk user last login Time through LDAP in Splunk Search

Splunk user last login Time through LDAP

Nawab — Sun, 20 Jul 2025 13:11:03 GMT

I have a requirement where I want to see all users and their last login time, we are connected through Ldap so setting > users > last login time doesnot work.

I tried below query but it only shows lastest users not all.

| rest /services/authentication/httpauth-tokens splunk_server=* | table timeAccessed userName splunk_server

Also I want to know when a user was created on splunk as well, as users are created via LDAP

Re: Splunk user last login Time through LDAP

gcusello — Sun, 20 Jul 2025 14:23:31 GMT

Hi @Nawab ,

if an LDAP user didn't login to Splunk, you don't see it, you can see only users that logged in at least one time.

To see the logged in users and the last login timestamp, you can read a simpe search like the following:

index=_audit action=success sourcetype=audittrail | stats latest(_time) AS _time count BY user

It's the same thing if you try to see by GUI the list of users in [Settings > Users]: you can see only internal users and the LDAP users that logged in.

Ciao.

Giuseppe

Re: Splunk user last login Time through LDAP

Nawab — Mon, 21 Jul 2025 06:57:41 GMT

This is the issue when you connect splunk with AD splunk will not store authentication logs locally and you will not be able to find in settings or in logs

i have different siem where i can see everything locally as users are local not through AD

Re: Splunk user last login Time through LDAP

tej57 — Mon, 21 Jul 2025 12:39:49 GMT

Hello @Nawab,

You might want to raise this as a new feature on ideas.splunk.com

Thanks,
Tejas.