Splunk Dashboard Query to Monitor Inactive Accounts

[Rosie2287]

Is there a query I can add to my splunk dashboard that will list accounts inactive over 35 days?

[gcusello]

Hi @Rosie2287,

if you want to list the accounts used in the last 90 days that weren't used in the last 35 days, you could run something like this:

I could be more detailes knowing which kind of logs yu want to monitor, are they Windows?

in this case I use index=wineventlog and EventCode=4624.

index=wineventlog EventCode=4624 earliest=-90d latest=now
| eval period=if(_time>now()-35*86400,"Last","Previous")
| stats dc(period) AS period_count values(period) AS period BY Account_name
| where period_count=1 AND period="Previous"
| table Account_name

Ciao.

Giuseppe

[Rosie2287]

Thank you for this but I am not sure if it will work for my set up since logs are deleted weekly.  These are windows events.

Do you have a query that may identify all enabled accounts and when their last login date was?

[ITWhisperer]

If the information has been deleted, Splunk can't report on it.

[Rosie2287]

Our splunk server keeps the logs for a lot longer.  Sorry I was unclear.