Hi All
i am new to splunk, I have a server with hostname server01 and i want to know who has logged in to the server in last 1 month. the event id is 4624 for successfully login, how can i use splunk query to fetch the information for last logged in user .
hi @risingflight143,
You need to provide sample data. You can use this sample query:
index=indexname sourcetype=sourcetypename eventid_fieldname=4624 earliest=-1mon
| fields userfield, logintime, other_fields_you_need
| stats latest(_time) as _time, latest(*) as * by userfield