In the Splunk App for UNIX/Linux, how do I check to see if a user is locked or is not in Splunk?

[bsaujla131984]

We have Splunk app for UNIX/Linux installed which we use for different purpose.

Currently I am looking for a way to check if a user is locked or not in Splunk, however there is not a field which seems to be useful to find that out.

Can someone assist with this please?

[jgbricker]

Perhaps you could use an ldap query against AD via the ldap search command rather than the nix add on if your users are in a Windows Active Directory.

https://docs.splunk.com/Documentation/SA-LdapSearch/2.1.7/User/Theldapsearchcommand

[harsmarvania57]

Hi,

Are you looking after Unix/Linux server level user checking whether user is locked or not on server and not looking after Splunk application user locked ? In this case you need to create custom script for Unix/Linux server to check whether user is locked or not and run at certain interval on all Unix/Linux servers and ingest those data into Splunk and then create Splunk query based on your requirement.

To run script on Universal Forwarder, you need to use [script://.....] stanza in inputs.conf

[493669]

If You are an admin and you want to check if certain user is locked or not then go to Settings>>Access Control>>Users and see if particular user is locked or not ..if it is locked then you will see unlock user option.