query to know who has logged in the server

[risingflight143]

Hi All

i am new to splunk, I have a server with hostname server01 and i want to know who has logged in to the server in last 1 month. the event id is 4624 for successfully login, how can i use splunk query to fetch the information for last logged in user .

[manjunathmeti]

hi @risingflight143,

You need to provide sample data. You can use this sample query:

index=indexname sourcetype=sourcetypename eventid_fieldname=4624 earliest=-1mon
| fields  userfield, logintime, other_fields_you_need
| stats latest(_time) as _time, latest(*) as * by userfield