Splunk Search

Pull list of user accounts with last logon

ctaylor3819
Engager

How do I pull together a chart of all our user accounts, with the last time that user logged in?

 

I currently have: 

eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681) | stats max(Time) by Logon_Account

 

I am getting the time but also need to display the date. I am also getting a lot of service accounts, is there an easy way to filter those out?

Labels (1)
0 Karma

ashvinpandey
Contributor

@ctaylor3819 Try using the below query for the date and time:

eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681) 
| stats latest(_time) as Latest_Time by Logon_Account 
| convert ctime(Latest_Time)

In order to filter the users you can you a lookup file containing the list of users you want to get or the list of genuine users and use a lookup command to get only those users.

Also, If this reply helps you, an upvote would be appreciated.

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...