Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk Enterprise Security
- :
- Re: Query to detect activity from inactive account
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Folks,
I want to create a correlation for inactive account activity including last login with timestamp and app used to login. Any suggestion would be helpful.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are a couple routes to go from here. My recommendation would be to create a lookup of the user accounts, this should include AD username, email address, first and last name, and/or some unique identifier of the user. This lookup can be manual or automated (recommend automating through ldap/AD integration with Splunk). Once the lookup is configured, integrate your log sources that will identify authentication activity (Windows, O365, VPN,etc). Validate the log sources are parsing the fields correctly and compliant to the CIM standards. Once validated, add those indexes of log sources into the Authentication datamodel, then use your SPL to identify your requested criteria. Example search below:
|tstats `summariesonly` values(Authentication.app) as app values(Authentication.action)
from datamodel=Authentication.Authentication
where [inputlookup terminated_users.csv |fields user |rename user as Authentication.user]
by _time, Authentication.src, Authentication.user
|`drop_dm_object_name(Authentication)`
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are a couple routes to go from here. My recommendation would be to create a lookup of the user accounts, this should include AD username, email address, first and last name, and/or some unique identifier of the user. This lookup can be manual or automated (recommend automating through ldap/AD integration with Splunk). Once the lookup is configured, integrate your log sources that will identify authentication activity (Windows, O365, VPN,etc). Validate the log sources are parsing the fields correctly and compliant to the CIM standards. Once validated, add those indexes of log sources into the Authentication datamodel, then use your SPL to identify your requested criteria. Example search below:
|tstats `summariesonly` values(Authentication.app) as app values(Authentication.action)
from datamodel=Authentication.Authentication
where [inputlookup terminated_users.csv |fields user |rename user as Authentication.user]
by _time, Authentication.src, Authentication.user
|`drop_dm_object_name(Authentication)`
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
