How to get all users with roles and last login

[Marta88]

Hi,

I would like to get the list of all users, with roles and last login via splunk query.

I tried the following query with a time range of "alltime" but it shows incorrect date for some users: 

index=_audit action="login attempt" | stats max(timestamp) by user

Thank you,

Kind regards

Marta

[ITWhisperer]

How do you know it is incorrect? How are you validating the results?

[Marta88]

I know that a colleague of mine login to the system today, instead for that query I get that the last login is in 2021.

KInd regards

Marta

[ITWhisperer]

Have you found any events in _audit for them? (Try searching by their id)

[Marta88]

Yes there is an event for my colleague for today.

[ITWhisperer]

What action is in that event? Why was it not found by your search?

[Marta88]

I solved it using the "first" function