I have a requirement where I want to see all users and their last login time, we are connected through Ldap so setting > users > last login time doesnot work.
I tried below query but it only shows lastest users not all.
| rest /services/authentication/httpauth-tokens splunk_server=* | table timeAccessed userName splunk_server
Also I want to know when a user was created on splunk as well, as users are created via LDAP
Hi @Nawab ,
if an LDAP user didn't login to Splunk, you don't see it, you can see only users that logged in at least one time.
To see the logged in users and the last login timestamp, you can read a simpe search like the following:
index=_audit action=success sourcetype=audittrail
| stats latest(_time) AS _time count BY user
It's the same thing if you try to see by GUI the list of users in [Settings > Users]: you can see only internal users and the LDAP users that logged in.
Ciao.
Giuseppe
This is the issue when you connect splunk with AD splunk will not store authentication logs locally and you will not be able to find in settings or in logs
i have different siem where i can see everything locally as users are local not through AD