Can you please help with a query that will pick the latest time entry captured for lastlogonTimestamp from AD logs for a particular list of users
Thanks, I used this query and it works:
index=msad lastLogonTimestamp | stats latest(lastLogonTimestamp) by employeeID
View solution in original post
You could probably leverage the dedup command and key in on user. This would only show the most recent event for that user. You could also leverage a lookup table file for all of the users you are interested in.