Is there a query I can add to my splunk dashboard that will list accounts inactive over 35 days?
Hi @Rosie2287,
if you want to list the accounts used in the last 90 days that weren't used in the last 35 days, you could run something like this:
I could be more detailes knowing which kind of logs yu want to monitor, are they Windows?
in this case I use index=wineventlog and EventCode=4624.
index=wineventlog EventCode=4624 earliest=-90d latest=now
| eval period=if(_time>now()-35*86400,"Last","Previous")
| stats dc(period) AS period_count values(period) AS period BY Account_name
| where period_count=1 AND period="Previous"
| table Account_name
Ciao.
Giuseppe
Thank you for this but I am not sure if it will work for my set up since logs are deleted weekly. These are windows events.
Do you have a query that may identify all enabled accounts and when their last login date was?
If the information has been deleted, Splunk can't report on it.
Our splunk server keeps the logs for a lot longer. Sorry I was unclear.