I checked the Field Extraction section and did NOT find any reference to "Last Logon". Being new to Splunk this is where I am unsure where fields come from and how they work which is fine for now, something for me to research.  I switched the SPL to the following and it still doesn't return the 'lastLogon' attribute from AD, would this be expected or should it in fact return the 'lastLogon' attribute?  | ldapsearch domain=mine search="(objectClass=user)" attrs=sAMAccountName,lastLogon | table sAMAccountName,lastLogon   ... View more

| ldapsearch domain=mine search="objectClass=user)" | where isnull(isCriticalSystemObject) | eval Enabled=if(match(userAccountControl,".*ACCOUNTDISABLE.*"),"False","True") | eval expires=if(userAccountControl="DONT_EXPIRE_PASSWD","True","False") | eval "Last Logon"=strftime(strptime(LastLogon, "%Y-%m-%dT%H:%M:%S.%QZ"),"%Y%m%d %H:%M:%S") | eval lastLogon=strptime(LastLogon, "%Y-%m-%dT%H:%M:%S.%QZ") | eval daysSincelogon=round((now()-lastlogon)/86400, 0) | table sAMAccountName,Enabled,daysSinceLogon,"Last Logon",expires   When I upgraded to version 9 I had pulled all the latest add-ons from Splunk directly. The new instance was stood up and then add-ons were installed, I pulled over lookups, etc. after the fact. I inherited this system and very green to Splunk (1 month of experience). ... View more