Splunk Search

Splunk user last login Time through LDAP

Nawab
Communicator

I have a requirement where I want to see all users and their last login time, we are connected through Ldap so setting > users > last login time doesnot work.

 

I tried below query but it only shows lastest users not all.

| rest /services/authentication/httpauth-tokens splunk_server=* | table timeAccessed userName splunk_server

Also I want to know when a user was created on splunk as well, as users are created via LDAP

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Nawab ,

if an LDAP user didn't login to Splunk, you don't see it, you can see only users that logged in at least one time.

To see the logged in users and the last login timestamp, you can read a simpe search like the following:

index=_audit  action=success sourcetype=audittrail
| stats latest(_time) AS _time count BY user

It's the same thing if you try to see by GUI the list of users in [Settings > Users]: you can see only internal users and the LDAP users that logged in.

Ciao.

Giuseppe

0 Karma

Nawab
Communicator

This is the issue when you connect splunk with AD splunk will not store authentication logs locally and you will not be able to find in settings or in logs

i have different siem where i can see everything locally as users are local not through AD

0 Karma

tej57
Builder

Hello @Nawab,

You might want to raise this as a new feature on ideas.splunk.com 

Thanks,
Tejas. 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...