Splunk Search

How to get list of users with user account created date and email associated to it?

testnoob
New Member

Hi All ,

The requirement is to get all usernames , username created date and email associated to it as below

username             username_created_date                 email_associated

testnoob                         03/22/2022                                testnoob@xxyy.com

how can i achieve this ? can you please help me 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Start with this REST command then add to the SPL as necessary to get the desired results.

| rest /servicesNS/-/-/admin/users
---
If this reply helps you, an upvote would be appreciated.
0 Karma

testnoob
New Member

 

| rest /servicesNS/-/-/admin/users

this does not give account created date , just the updated date  to the account

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm pretty sure Splunk does not store the creation time of an account other than what's in the audit index.  Don't trust the updated time, either, as I've seen it be wrong (zero) almost all the time.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

testnoob
New Member

index=_audit action=edit_user operation=create
|rename object as user
|eval timestamp=strptime(timestamp, "%m-%d-%Y %H:%M:%S.%3N")
|convert timeformat="%d/%b/%Y" ctime(timestamp)
|table user timestamp

If i use above query i get only part of the users ( 17 users ) with username and account created date , but not whole list of users ( 400 users) with username and account created date.

Is there any restriction in splunk , why is it only pulling part of the users list and not complete ?

 

 

 

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That query will only show recently-created accounts - those created during the retention period of the audit index.

To keep those events longer, consider writing them to a summary index with a longer retention period.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...