Splunk Search
Highlighted

Inactive Users

New Member

Hello Splunk,

I am attempting to write a query that searches Splunk for any users that have not logged in for the past 60 days. This is a compliance requirement and all query's are not working.

Our login sourcetype is sam:xml

My latest search resulted in zero events:

index=internal source=*webservice.log action=login status=success | eval lastlogintime=time | eval currenttime=now() | eval timesincelastloginsecs=currenttime-lastlogintime | where timesincelastlogin_secs > 2592000 | table user

Tags (3)
0 Karma
Highlighted

Re: Inactive Users

Communicator

Try this

index=audit action="login attempt" info=succeeded |stats max(timestamp) as lastlogintime by user | eval lastlogintime = strptime('lastlogintime', "%m-%d-%Y %H:%M:%S")
| eval current
time=now() | eval timesincelastloginsecs=currenttime-lastlogintime | where timesincelastlogin_secs > 2592000 | table user

Highlighted

Re: Inactive Users

SplunkTrust
SplunkTrust

very good here!
for 60 days change 2592000 (this is 30 days) to 5184000

0 Karma
Highlighted

Re: Inactive Users

Communicator

You are right

0 Karma
Highlighted

Re: Inactive Users

Splunk Employee
Splunk Employee

@williamdicker - Did the answer provided by naidusadanala help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma