Splunk Search

Pull list of user accounts with last logon

ctaylor3819
Engager

How do I pull together a chart of all our user accounts, with the last time that user logged in?

 

I currently have: 

eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681) | stats max(Time) by Logon_Account

 

I am getting the time but also need to display the date. I am also getting a lot of service accounts, is there an easy way to filter those out?

Labels (1)
0 Karma

ashvinpandey
Communicator

@ctaylor3819 Try using the below query for the date and time:

eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681) 
| stats latest(_time) as Latest_Time by Logon_Account 
| convert ctime(Latest_Time)

In order to filter the users you can you a lookup file containing the list of users you want to get or the list of genuine users and use a lookup command to get only those users.

Also, If this reply helps you, an upvote would be appreciated.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!