Query to find the latest time entry for lastlogonTimestamp from AD logs for a list of users?

[LintuMathews]

Hi

Can you please help with a query that will pick the latest time entry captured for lastlogonTimestamp from AD logs for a particular list of users

[LintuMathews · Accepted solution]

Thanks, I used this query and it works:

index=msad lastLogonTimestamp | stats latest(lastLogonTimestamp) by employeeID

[jodros]

You could probably leverage the dedup command and key in on user. This would only show the most recent event for that user. You could also leverage a lookup table file for all of the users you are interested in.