Splunk Search

find users who hasnt logged in the past 30 days

iiix94
Loves-to-Learn

Hello! I have a lookup table with fields 'name' and 'last_login'. I'm trying to find users who haven't logged in the past 30 days. 
Originally, I had this:

 

| inputlookup Users.csv
| where strptime('last_login',"%m/%d/%Y %H:%M:%S") < relative_time(now(),"-30d@d") OR isnull(last_login)
| sort last_login desc

 

However, it is only outputting users that logged in 30+ days ago. I would like to exclude users who are still logging in recently (in those 30 days). Thank you! Any help would be greatly appreciated!

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is the issue here - assuming your lookup is up to date, the search will do what you are asking for. Or is it that your lookup is not up to date and you want to check more recent events which are not in the lookup?

0 Karma

iiix94
Loves-to-Learn

The lookup is updated with recent login events. This query pulled users who logged in 30 days ago, including users who are still logging in recently. I would like to exclude those users. I would like users whose last login was 30 days ago, so permissions can be removed!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| inputlookup Users.csv
| eval last_login = strptime('last_login',"%m/%d/%Y %H:%M:%S")
| sort 0 last_login desc
| stats first(last_login) as last_login by user
| where last_login < relative_time(now(),"-30d@d")
0 Karma

iiix94
Loves-to-Learn

Hmm.. Not working..

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...