Hi @chrodriguez,
So you are specifically looking for the account "wmsadmin", which is disabled to see the last time that it was used to log in?
Have you been collecting logs in your environment with splunk forwarders since "9/20/2011" the date of the lastLogonTimestamp?
Let us know what happens!
V/R,
nwuest
Hi @chrodriguez,
So you are specifically looking for the account "wmsadmin", which is disabled to see the last time that it was used to log in?
Have you been collecting logs in your environment with splunk forwarders since "9/20/2011" the date of the lastLogonTimestamp?
Let us know what happens!
V/R,
nwuest
thanks for the insight, I completely forgot that we have only had splunk introduced since 2016. So thats why its not populating data from 2011.
That doesn't return anything, I really need to focus on "A User" not just everything. I ran this, and it returned nothing for the account but then when I try against my user account it does return data. The account wmsadmin is indeed an actual user account that is disabled and the "lastLogonTimestamp" has a value or date of 9/20/2011.
index=wineventlog sourcetype=WinEventLog:Security (EventCode=4624 OR EventCode=4634 "wmsadmin")
| eval day=strftime(_time,"%d/%m/%Y")
| stats earliest(_time) AS earliest latest(_time) AS latest by user host day
| eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S"), latest=strftime(latest,"%d/%m/%Y %H.%M.%S")
Hi @chrodriguez
Try this:
EventCode=4624 | dedup ComputerName | table ComputerName _time
View solution in original post
Let us know if this works for you
V/R,
nwuest
That doesn't return anything, I really need to focus on "A User" not just everything. I ran this, and it returned nothing for the account but then when I try against my user account it does return data. The account wmsadmin is indeed an actual user account that is disabled and the "lastLogonTimestamp" has a value or date of 9/20/2011. index=wineventlog sourcetype=WinEventLog:Security (EventCode=4624 OR EventCode=4634 "wmsadmin") | eval day=strftime(_time,"%d/%m/%Y") | stats earliest(_time) AS earliest latest(_time) AS latest by user host day | eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S"), latest=strftime(latest,"%d/%m/%Y %H.%M.%S")