disabled user list

Path Finder

how to get list of disabled users in splunk ? any query ?

i was checking for orphaned object query :

| rest timeout=600 splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0
| search orphan=1

does it help ?

0 Karma


do you mean inactive users?

 | rest /services/authentication/users splunk_server=local 
 | fields realname, title
 | rename title as user
 | join user type=left [
    | search index=_audit action="login attempt" earliest=-12mon
    | stats max(timestamp) as _time by user, sourcetype
 | where isnull(sourcetype)
 | fields - sourcetype

Also, have a look at this answer

let me know if this helps!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.