Splunk Enterprise Security

How to find LDAP accounts that have been disabled for longer then 30 days

gthomas719
New Member

Hi everyone.
I'm new to Splunk and trying to work on a search that would return accounts in LDAP that have already been disabled for 30 days or longer. I have found that the event code for disabled accounts is 4725, and I can see accounts that have been set to disable within the last 30/60/90... days, but not sure how to see ones that have been sitting in disabled status for 30 days or longer

Any assistance is MUCH appreciated!

0 Karma

damiensurat
Contributor

so you can use the timestamp from the event data and then calculate in seconds the diff between now and the date of the event
timestamp. this can be used to generate a new field which will give you the offset in time in days:

your splunk search
| eval now = now()
| eval secDiff = (now - _time)
| eval ageOfLastEventInDays = round(secDiff/86400,2)
| search ageOfLastEventInDays >= 30

0 Karma

gthomas719
New Member

So would the search look like this:

index="wineventlog" EventCode=4725
| eval now = now()
| eval secDiff = (now - _time)
| eval ageOfLastEventInDays = round(secDiff/86400,2)
| search ageOfLastEventInDays >= 30

0 Karma

Prakash493
Communicator

Their is a way to determine if any users has not been logged to splunk from last 30 days but if you are looking for ldap disabled accounts , if its indexed then you can get it.

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...