topic Re: Search for Users that have not Logged-in in the Last 30 Days in Splunk Search

Search for Users that have not Logged-in in the Last 30 Days

jodros — Mon, 28 Sep 2020 16:27:53 GMT

I need to create a search that will look back over the last year and list all users that have not logged into a webserver. I was thinking about running a search that normalized, deduped, and listed all users in a table. Then I wanted to run a search against the table for all users with timestamps older than 30 days. I have the first part working, but not the search against the table. Any help would be appreciated.

sourcetype=webserver audit_event=AUTHN_SUCCESS tag=prod | eval username=lower(username) | dedup username | table _time username | search _time>-30d

Re: Search for Users that have not Logged-in in the Last 30 Days

somesoni2 — Thu, 24 Apr 2014 16:16:04 GMT

Try this

sourcetype=webserver audit_event=AUTHN_SUCCESS tag=prod | eval username=lower(username) | dedup username | table _time username | eval age_days=(now()-_time)/(60*60*24) | where age_days > 30

Re: Search for Users that have not Logged-in in the Last 30 Days

jodros — Mon, 28 Apr 2014 18:25:54 GMT

Thanks! This worked for me.