Search for users Splunk login activity for * days

[crlunde]

Hello,

I'm trying to search Splunk for user activity pertaining to logging into Splunk for X # of days. Everything I've tried so far returns some results but not all.  I've searched the _audit index as well as |rest /services/authentication/httpauth-tokens | fields userName, timeAccessed |dedup userName sortby timeAccessed. 

Does anyone have a search for this or a dashboard that would pull this information?

I need:

user, date last accessed at a minimum.

Thanks,

Craig

[isoutamo]

Hi

something like this

index = _audit user="*" action="login attempt" info=succeeded
| stats count values(_time) as lTimes by users
| convert ctime(lTimes) as loginTimes

r. Ismo  

[crlunde]

Thank you for your response. 

Unfortunately that query didn't pull any data.

I can get user / last logon date using this query but cannot pull data for older dates.

| rest /services/authentication/httpauth-tokens | fields userName, timeAccessed | dedup suerName sort by timeAccessed