×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Bobmc
Observer
Member since: ‎09-08-2022
‎09-08-2022
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎09-08-2022
View All

Re: Stale Active Users in Active Directory

by in Splunk Search
‎09-08-2022 12:46 PM
‎09-08-2022 12:46 PM
My AD boxes are reporting to Splunk, however it just the event log data.  So I can pull data on Event IDs such as 4624 (successful login) but formatting that so it only shows accounts that haven't done that for a period of time and do not have the Event ID 4725 (account was disabled) associated to it is my issue.   I hope that helps make some sense..  Thanks Bob ... View more

Re: Stale Active Users in Active Directory

by in Splunk Search
‎09-08-2022 10:43 AM
‎09-08-2022 10:43 AM
Thanks @andrew_nelson ..unfortunantly though we do not have this Add on installed and due to our environment I'm not able to install this anytime soon.  We've recently moved our Splunk instance to a cloud provided and I'm doubtful it will be done before my deadline to provide this data to management.  Is there a query, without this addon that will work? Thanks, Bob ... View more

Can someone help with a sample search to find Stal...

by in Splunk Search
‎09-08-2022 08:25 AM
‎09-08-2022 08:25 AM
Hello, I'm a bit new to Splunk and I'm trying to run a query that shows me users in Active directory that are still enabled but haven't logged in for past 30 days.  I've tried searching through varies post but none seem to be exactly what I'm looking for.  I may have overlooked it so If someone can point me in the right direction or provide a sample query to get me started I'd be very grateful. Thanks, Bob ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎09-08-2022 06:54 PM