All Apps and Add-ons

In the Splunk App for UNIX/Linux, how do I check to see if a user is locked or is not in Splunk?

bsaujla131984
Path Finder

We have Splunk app for UNIX/Linux installed which we use for different purpose.

Currently I am looking for a way to check if a user is locked or not in Splunk, however there is not a field which seems to be useful to find that out.

Can someone assist with this please?

Tags (1)
0 Karma

jgbricker
Contributor

Perhaps you could use an ldap query against AD via the ldap search command rather than the nix add on if your users are in a Windows Active Directory.

https://docs.splunk.com/Documentation/SA-LdapSearch/2.1.7/User/Theldapsearchcommand

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Are you looking after Unix/Linux server level user checking whether user is locked or not on server and not looking after Splunk application user locked ? In this case you need to create custom script for Unix/Linux server to check whether user is locked or not and run at certain interval on all Unix/Linux servers and ingest those data into Splunk and then create Splunk query based on your requirement.

To run script on Universal Forwarder, you need to use [script://.....] stanza in inputs.conf

0 Karma

493669
Super Champion

If You are an admin and you want to check if certain user is locked or not then go to Settings>>Access Control>>Users and see if particular user is locked or not ..if it is locked then you will see unlock user option.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!