I have a search that looks at AD data to determine if a user was disabled more than 6 months ago.  My intention was for the search to only produce results if the user was disabled more than 6 months ago, AND the user is still present in AD.  The the results would remind us to remove those users if they haven't already been removed.   The problem is that the results include users that were already deleted from AD.  I would ideally like to take the results and compare them to the latest import of data from AD (which happens once a day).  If the user is not present in the latest import, then we can assume the user was already removed, and that user should not be in the results.   Thanks for your help.  Feel free to suggest any optimizations to my search.     index="msad" sourcetype="msad:users" Enabled!="" | streamstats current=f last(Enabled) as new_Enabled last(_time) as time_of_change by SamAccountName | where Enabled!=new_Enabled | convert ctime(time_of_change) as time_of_change | rename Enabled as old_Enabled | dedup SamAccountName | where new_Enabled="False" AND strptime(time_of_change, "%m/%d/%Y %H:%M:%S")<relative_time(now(),"-180d@d") | table time_of_change, SamAccountName, old_Enabled , new_Enabled, DistinguishedName, AccountExpirationDate       ... View more

I am both new to splunk and not a database expert. So I'm asking for your help... What should I use, Batch Input or Rising Column? From reading the descriptions, it seems to me like a combination of both are needed. Here is my case: The database has tons of tables, most of these have a generally fixed number of rows (only adds a row when a new member or application is added for example), and the existing rows are updated/modified frequently. The other tables (less tables, but contain the bulk of the data) have new rows added very frequently, but existing rows are never updated/modified. What is the best way to get this from my MS SQL Server to splunk using DBConnect v3.0.2? Thanks in advance for your help. ... View more

I am looking to get desktop (domain user) interactive and RDP logons from Domain Controller logs. I don't know if this is possible. I have looked up and down splunk>answers and found similar questions answered, but none definitively answer my question in particular. So when a domain user logs on to a desktop PC anywhere in the domain, I want that to show up on my search. So far I am searching for (EventCode=528 OR EventCode=540 OR EventCode=552 OR EventCode=4624 OR EventCode=4648). Really only 4624 gets results, and the only results I am seeing are for Logon Type 3 which correspond to mapped network drives and printers, etc. Not the stuff I'm interesting in. I'm interested in Logon Type 2, 7, and 10 mostly. The list of Logon Types can be found at https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624 If I look at the Event Viewer on a client PC, I do see Event Code 4624 with the Logon Types I want (3, 7, 10), but these don't appear on domain controller logs. Am I missing something? I'm trying to avoid installing the UF and TA on each workstation as it would likely make me go over my license. Is there a way for me to tell if a user performed an interactive/remote logon or unlock from my domain controller logs? Thanks for your help. ... View more

Using Splunk Support for Active Directory 2.1.3. When we run an ldapsearch to get accountExpires or Enabled properties, no data comes back. When we run a similar search using PowerShell on Active Directory, a value such as "9223372036854775807" for accountExpires and (True or False) for Enabled is returned. My search is below: | ldapsearch search="(&(objectClass=user)(!(objectClass=computer)))" attrs="sAMAccountName,accountExpires,Enabled" | table sAMAccountName,accountExpires,Enabled Any help would be appreciated. Thanks! ... View more