Splunk user last login Time through LDAP

[Nawab]

I have a requirement where I want to see all users and their last login time, we are connected through Ldap so setting > users > last login time doesnot work.

I tried below query but it only shows lastest users not all.

| rest /services/authentication/httpauth-tokens splunk_server=* | table timeAccessed userName splunk_server

Also I want to know when a user was created on splunk as well, as users are created via LDAP

[gcusello]

Hi @Nawab ,

if an LDAP user didn't login to Splunk, you don't see it, you can see only users that logged in at least one time.

To see the logged in users and the last login timestamp, you can read a simpe search like the following:

index=_audit  action=success sourcetype=audittrail
| stats latest(_time) AS _time count BY user

It's the same thing if you try to see by GUI the list of users in [Settings > Users]: you can see only internal users and the LDAP users that logged in.

Ciao.

Giuseppe

[Nawab]

This is the issue when you connect splunk with AD splunk will not store authentication logs locally and you will not be able to find in settings or in logs

i have different siem where i can see everything locally as users are local not through AD

[tej57]

Hello @Nawab,

You might want to raise this as a new feature on ideas.splunk.com 

Thanks,
Tejas.