Hi.
The topic is probably already hackneyed, but I'll ask you anyway.
Classic case - the user has not logon for more than 90 days.
I want to make a request through - ldapsearch, With enrichment through blood pressure AD.
There is an example request https://docs.splunksecurityessentials.com/content-detail/old_passwords/
Took from the request only - there were no login for more than 90 days.
| ldapsearch search="(&(objectclass=user)(!(objectClass=computer)))" attrs="sAMAccountName,pwdLastSet,lastLogonTimestamp,whenCreated,badPwdCount,logonCount" | fields - _raw host _time
| convert timeformat="%Y-%m-%dT%H:%M:%S.%6QZ" mktime(lastLogonTimestamp) | convert timeformat="%Y%m%d%H%M%S.0Z"
| where lastLogonTimestamp > relative_time(now(), "-90d")
| convert ctime(lastLogonTimestamp)
The request is processed and takes away attributes from AD, but the time of the last login-lastLogonTimestamp does not show the former not 90 days.
Where is the error in the request ?
