As someone who has never seen Windows eventlog in Splunk, I wonder how would you determine that a user even exists if he or she hasn't had activity for a long time? (Assuming your search period is finite.) Yeah this is exactly the reason I was going down the Add-On for AD and script routes to get the full list of AD users.  Through the WinEventLog, Splunk can tell you what happened and when, but it can't tell you an account exists if it doesn't have any events related to that account. A full inventory of user accounts is needed to determine what accounts aren't being used. ... View more