Splunk Search

Pull list of user accounts with last logon

ctaylor3819
Engager

How do I pull together a chart of all our user accounts, with the last time that user logged in?

 

I currently have: 

eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681) | stats max(Time) by Logon_Account

 

I am getting the time but also need to display the date. I am also getting a lot of service accounts, is there an easy way to filter those out?

0 Karma

ashvinpandey
Contributor

@ctaylor3819 Try using the below query for the date and time:

eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681) 
| stats latest(_time) as Latest_Time by Logon_Account 
| convert ctime(Latest_Time)

In order to filter the users you can you a lookup file containing the list of users you want to get or the list of genuine users and use a lookup command to get only those users.

Also, If this reply helps you, an upvote would be appreciated.

Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...