Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About GattyBiggz
GattyBiggz
Loves-to-Learn
Member since:
05-24-2023
Tuesday
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 05-24-2023 |
Activity Feed
- Posted Re: Help Fix My Search on Splunk Search. a week ago
- Posted Re: Help Fix My Search on Splunk Search. a week ago
- Posted Re: Help Fix My Search on Splunk Search. a week ago
- Posted Re: Help Fix My Search on Splunk Search. a week ago
- Tagged Help Fix My Search on Splunk Search. a week ago
- Posted Help Fix My Search on Splunk Search. a week ago
- Posted Issue with my search query on Getting Data In. a week ago
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
a week ago
{
"AppAccessContext": {
"AADSessionId": "*",
"ClientAppName": "*",
"CorrelationId": "*",
"UniqueTokenId": "*"
},
"CreationTime": "2025-05-30T21:00:55",
"Id": "*",
"Operation": "FileAccessed",
"OrganizationId": "*",
"RecordType": 6,
"UserKey": "*",
"UserType": 0,
"Version": 1,
"Workload": "SharePoint",
"ClientIP": "*",
"UserId": "*",
"AuthenticationType": "OAuth",
"BrowserName": "",
"BrowserVersion": "",
"CorrelationId": "*",
"EventSource": "SharePoint",
"GeoLocation": "*",
"IsManagedDevice": false,
"ItemType": "File",
"ListId": "*",
"ListItemUniqueId": "*",
"Platform": "*",
"Site": "*",
"UserAgent": "*",
"WebId": "*",
"DeviceDisplayName": "*",
"HighPriorityMediaProcessing": false,
"ListBaseType": 1,
"ListServerTemplate": 101,
"SiteUrl": "*",
"SourceRelativeUrl": "*",
"SourceFileName": "*",
"SourceFileExtension": "docx",
"ApplicationDisplayName": "WebWord",
"ObjectId": "*"
}
... View more
a week ago
So this did not work, it still giving me the log from March. Here is the creation time of the latest log compared to what its giving me.
... View more
a week ago
This is the log that is displaying in my search, but I need it to display the most recent, not the oldest. Thank you
... View more
a week ago
The logs in May also have a CreationTime of May. But my search seems to be showing the oldest log it can find not the latest.
... View more
a week ago
index="*azure*" UserId="*#EXT#*" earliest=-300d@d latest=now | eval activity_time = coalesce(strptime(CreationTime, "%Y-%m-%dT%H:%M:%S"), _time) | stats latest(activity_time) AS last_seen BY UserId | eval days_since_last_activity = round((now() - last_seen) / 86400, 0) | where days_since_last_activity > 180 | eval last_seen_readable = strftime(last_seen, "%Y-%m-%d %H:%M:%S") | table UserId last_seen_readable days_since_last_activity | sort -days_since_last_activity My search is showing users as last active in March however when I dive into the logs for a specific user I can see that same user had activity in May, how can I fix this?
... View more
- Tags:
- Azure Logs
Labels
- Labels:
-
other
a week ago
Greeting, I am trying to identify users who have not had any activity in O365 for over 180 days, however my search is pulling old logs and listing users based on those old longs but when I got into events I can see logs from some of those users that are not over 180 days old. How do I fix this issue.
... View more
Labels
- Labels:
-
other
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Tuesday
|
