Splunk Search

When Was The User Account Created

IRHM73
Motivator

Hi, I wonder whether someone may be able to help me please.

I'm using the query below to list the current user accounts:

|rest /services/authentication/users splunk_server=local 
 |fields realname
 |rename realname as user
 |table user

Could someone tell me please is there a way to determine when the account was created.

I have tried:

|rest /services/authentication/users splunk_server=local 

But there is no such field that I can see, only when the account was last updated.

I just wonder whether someone may be able to point me in the right direction as to where I may find this information.

Many thanks and kind regards

Chris

0 Karma
1 Solution

jeffland
Champion

I don't think this info is available. If you have a look at your .conf and according .meta files, you can see that this data is not recorded, only last modtime. I doubt the rest endpoint looks any place other than there.

You could search the index _audit for the earliest occurence of user names.

View solution in original post

0 Karma

IRHM73
Motivator

Hi, for those of you who may be interested, I think I may have found a solution to this using the query below:

index=_audit action=edit_user operation=create
|rename object as user
|eval timestamp=strptime(timestamp, "%m-%d-%Y %H:%M:%S.%3N") 
|convert timeformat="%d/%b/%Y" ctime(timestamp)
|table user timestamp

I hope this helps.

Many thanks and kind regards

Chris

Julian_Gudiel_S
Explorer

Great ! Thank you !

I modified this query to get the real names :

index=_audit action=edit_user operation=create
| join user type=left [| rest /services/authentication/users splunk_server=local | fields realname, title | rename realname as user_name, title as user]
| join object type=left [| rest /services/authentication/users splunk_server=local | fields realname, title | rename realname as edited_user_name, title as object]
| sort - timestamp
| eval timestamp=strptime(timestamp, "%m-%d-%Y %H:%M:%S.%3N") 
| convert timeformat="%d/%m/%Y %H:%M:%S.%3N" ctime(timestamp)
| rename user as user_id, object as edited_user_id
| table user_id user_name edited_user_id edited_user_name timestamp
0 Karma

jeffland
Champion

I don't think this info is available. If you have a look at your .conf and according .meta files, you can see that this data is not recorded, only last modtime. I doubt the rest endpoint looks any place other than there.

You could search the index _audit for the earliest occurence of user names.

0 Karma

IRHM73
Motivator

Hi @jeffland, that's a shame, but thank you for taking the time to come back to me with this.

Kind regards

Chris

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...