Splunk Search

Pull list of user accounts with last logon

ctaylor3819
Engager

How do I pull together a chart of all our user accounts, with the last time that user logged in?

 

I currently have: 

eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681) | stats max(Time) by Logon_Account

 

I am getting the time but also need to display the date. I am also getting a lot of service accounts, is there an easy way to filter those out?

0 Karma

ashvinpandey
Contributor

@ctaylor3819 Try using the below query for the date and time:

eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681) 
| stats latest(_time) as Latest_Time by Logon_Account 
| convert ctime(Latest_Time)

In order to filter the users you can you a lookup file containing the list of users you want to get or the list of genuine users and use a lookup command to get only those users.

Also, If this reply helps you, an upvote would be appreciated.

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...