We have Splunk app for UNIX/Linux installed which we use for different purpose.
Currently I am looking for a way to check if a user is locked or not in Splunk, however there is not a field which seems to be useful to find that out.
Can someone assist with this please?
Perhaps you could use an ldap query against AD via the ldap search command rather than the nix add on if your users are in a Windows Active Directory.
https://docs.splunk.com/Documentation/SA-LdapSearch/2.1.7/User/Theldapsearchcommand
Hi,
Are you looking after Unix/Linux server level user checking whether user is locked or not on server and not looking after Splunk application user locked ? In this case you need to create custom script for Unix/Linux server to check whether user is locked or not and run at certain interval on all Unix/Linux servers and ingest those data into Splunk and then create Splunk query based on your requirement.
To run script on Universal Forwarder, you need to use [script://.....]
stanza in inputs.conf
If You are an admin and you want to check if certain user is locked or not then go to Settings>>Access Control>>Users
and see if particular user is locked or not ..if it is locked then you will see unlock user option.