Search for inactive Splunk users

[Ellen]

Is there a search for finding Splunk instance users who have not logged in for X amount of time eg. not logged in for the last 6 months? audit.log contains information on users last login attempt that succeeded. Would a look up setup be the approach?

[gkanapathy · Accepted solution]

Obviously it's easy to find who has logged in within some past period of time. To find the complement of this, you have to know the full set, i.e., you need a list of all possible users who might have logged in. You can get this either from some canonical external source, or you could generate it by running over an even longer period:

 | inputlookup allusers | search NOT [ index=_audit action="login attempt" info="succeeded" earliest=-6mon | dedup user | fields user ]

or

 index=_audit action="login attempt" info="succeeded" earliest=-18mon latest=-6mon NOT [ index=_audit action="login attempt" info="succeeded" earliest=-6mon | dedup user | fields user ]

You could also generate the lookup on an ongoing basis with a scheduled search:

 index=_audit action="login attempt" info="succeeded" | dedup user | fields user | inputlookup append=t allusers | dedup user | outputlookup allusers

You would run this once over the long past to generate the initial table, then run it every (say) 24 hours over the past 24 hours to keep it up-to-date.

[V_at_Splunk]

You've pretty much answered your own question. Search for source=audit.log endmonthsago=6, and then | DEDUP user.

Splunk makes it easy!    8)

[V_at_Splunk]

And anonymous downvoters make one loath to answer questions.