All Apps and Add-ons

How to edit my ldapsearch to find a user's last login age (lastLogonTimestamp - current time)?

maclel
Engager

Hi,

With an LDAP search (ldapsearch), how do I go about getting a user's lastLogonTimestamp minus the current time (of search), in say days. i.e. someone hasn't logged in since 2016-06-02T00:00:00.000000Z is roughly 60 days...

Current search is:

| ldapsearch domain=internal search="(&(objectclass=user)(!(objectClass=computer)))" limit=10 attrs="sAMAccountName, displayName, distinguishedName, userAccountControl, whenCreated, accountExpires, lastLogonTimestamp"
| makemv userAccountControl
| search dn!="*OU=_Disabled Users*"
| eval accountDisable=if(userAccountControl == "ACCOUNTDISABLE
NORMAL_ACCOUNT", "Yes", "No")
| eval dontExpirePasswd=if(userAccountControl="DONT_EXPIRE_PASSWD
NORMAL_ACCOUNT", "Yes", "No")
| eval passwdNotRequired=if(userAccountControl == "PASSWD_NOTREQD
NORMAL_ACCOUNT", "Yes", "No")
| eval lastLoginAge=(lastLogonTimestamp - now())
| table sAMAccountName, displayName, dn, userAccountControl, whenCreated, accountDisable, dontExpirePasswd, passwdNotRequired, lastLoginAge, lastLogonTimestamp, accountExpires

Just not sure which eval time function command to use.

Environment:
Linux 6.3.3 Splunk Enterprise servers
MSInfra 1.3.0
SA-ldapsearch 2.1.3
Splunk Add-on for Microsoft Active Directory 1.0.0 (deployed to a couple DCs via UFs)

0 Karma
1 Solution

sundareshr
Legend

For time compares, you have to first convert the time to epoch format (seconds). The difference between two times, is always in seconds. So, to get the time in days, you can divide by 86400 (secs per day)

| ldapsearch domain=internal search="(&(objectclass=user)(!(objectClass=computer)))" limit=10 attrs="sAMAccountName, displayName, distinguishedName, userAccountControl, whenCreated, accountExpires, lastLogonTimestamp"
 | makemv userAccountControl
 | search dn!="*OU=_Disabled Users*"
 | eval accountDisable=if(userAccountControl == "ACCOUNTDISABLE
 NORMAL_ACCOUNT", "Yes", "No")
 | eval dontExpirePasswd=if(userAccountControl="DONT_EXPIRE_PASSWD
 NORMAL_ACCOUNT", "Yes", "No")
 | eval passwdNotRequired=if(userAccountControl == "PASSWD_NOTREQD
 NORMAL_ACCOUNT", "Yes", "No")
| eval lastLoginAge_epoch=strptime(lastLogonTimestamp, "%Y-%m-%dT%H:%M:%S")
 | eval lastLoginAge=round((lastLoginAge_epoch - now())/86400, 0)
 | table sAMAccountName, displayName, dn, userAccountControl, whenCreated, accountDisable, dontExpirePasswd, passwdNotRequired, lastLoginAge, lastLogonTimestamp, accountExpires

View solution in original post

sundareshr
Legend

For time compares, you have to first convert the time to epoch format (seconds). The difference between two times, is always in seconds. So, to get the time in days, you can divide by 86400 (secs per day)

| ldapsearch domain=internal search="(&(objectclass=user)(!(objectClass=computer)))" limit=10 attrs="sAMAccountName, displayName, distinguishedName, userAccountControl, whenCreated, accountExpires, lastLogonTimestamp"
 | makemv userAccountControl
 | search dn!="*OU=_Disabled Users*"
 | eval accountDisable=if(userAccountControl == "ACCOUNTDISABLE
 NORMAL_ACCOUNT", "Yes", "No")
 | eval dontExpirePasswd=if(userAccountControl="DONT_EXPIRE_PASSWD
 NORMAL_ACCOUNT", "Yes", "No")
 | eval passwdNotRequired=if(userAccountControl == "PASSWD_NOTREQD
 NORMAL_ACCOUNT", "Yes", "No")
| eval lastLoginAge_epoch=strptime(lastLogonTimestamp, "%Y-%m-%dT%H:%M:%S")
 | eval lastLoginAge=round((lastLoginAge_epoch - now())/86400, 0)
 | table sAMAccountName, displayName, dn, userAccountControl, whenCreated, accountDisable, dontExpirePasswd, passwdNotRequired, lastLoginAge, lastLogonTimestamp, accountExpires
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...