Pull list of user accounts with last logon

[ctaylor3819]

How do I pull together a chart of all our user accounts, with the last time that user logged in?

I currently have: 

eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681) | stats max(Time) by Logon_Account

I am getting the time but also need to display the date. I am also getting a lot of service accounts, is there an easy way to filter those out?

[ashvinpandey]

@ctaylor3819 Try using the below query for the date and time:

eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681) 
| stats latest(_time) as Latest_Time by Logon_Account 
| convert ctime(Latest_Time)

In order to filter the users you can you a lookup file containing the list of users you want to get or the list of genuine users and use a lookup command to get only those users.

Also, If this reply helps you, an upvote would be appreciated.