Splunk Search

Query to find the latest time entry for lastlogonTimestamp from AD logs for a list of users?

Explorer

Hi

Can you please help with a query that will pick the latest time entry captured for lastlogonTimestamp from AD logs for a particular list of users

Tags (2)
1 Solution

Explorer

Thanks, I used this query and it works:

index=msad lastLogonTimestamp | stats latest(lastLogonTimestamp) by employeeID

View solution in original post

Explorer

Thanks, I used this query and it works:

index=msad lastLogonTimestamp | stats latest(lastLogonTimestamp) by employeeID

View solution in original post

Builder

You could probably leverage the dedup command and key in on user. This would only show the most recent event for that user. You could also leverage a lookup table file for all of the users you are interested in.

0 Karma