Splunk Search

How to search for users who haven't signed in to an app over the last 30 days.

stegray93
Explorer

Hello,

I'm trying to figure out the search that would be needed to find any users who haven't logged in to an application over the last 30 days.

I don't really know what to give as an example as I've tried multiple different ways and none of them work.

So basically the core of the search is below.

source=okta:event action.message="Sign-in successful"

How do I then make this only show me results of users who haven't created a sign-in successful event in the last 30 days? Then table them as user.

Tags (1)
0 Karma
1 Solution

sundareshr
Legend

Let's assume you have a field called userid. Try this search.

source=okta:event action.message="Sign-in successful" | stats latest(_time) as LastLogin by userid | where LastLogin<relative_time(now(), "-30d")

View solution in original post

sundareshr
Legend

Let's assume you have a field called userid. Try this search.

source=okta:event action.message="Sign-in successful" | stats latest(_time) as LastLogin by userid | where LastLogin<relative_time(now(), "-30d")

stegray93
Explorer

thanks it's seem to of worked. Do you know how I can change the LastLogin field to look more user friendly? It's currently displaying it as a load of numbers, can I get that show the date of the last time they logged in?

0 Karma

woodcock
Esteemed Legend

Add this:

... | fieldformat LastLogin = strftime(LastLogin, "%m/%d/%Y %H:%M:%S")
0 Karma

stegray93
Explorer

Awesome, thanks guys you've made my day 😄

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...