Hi,
Basically I need to find out when some old service accounts were last used/if they have ever been used. We have 1000's and would like a report string that would report based on all accounts found in a particular OU. I have one for searching specific accounts but copy and pasting all the account names is very tedious.
This is what I have for searching accounts:
index=wineventlog source="WinEventLog:Security"
Account_Name=redbox.service
host!=DOMAIN, host!=DOMAIN, host!=DOMAIN, host!=DOMAIN* | stats count by Account_Name, host
I am very new to splunk so any suggestions would be much appreciated. If you know of a better way to do this then feel free to let me know!
