Splunk Search

Search for Users that have not Logged-in in the Last 30 Days

jodros
Builder

I need to create a search that will look back over the last year and list all users that have not logged into a webserver. I was thinking about running a search that normalized, deduped, and listed all users in a table. Then I wanted to run a search against the table for all users with timestamps older than 30 days. I have the first part working, but not the search against the table. Any help would be appreciated.

sourcetype=webserver audit_event=AUTHN_SUCCESS tag=prod | eval username=lower(username) | dedup username | table _time username | search _time>-30d

Tags (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

sourcetype=webserver audit_event=AUTHN_SUCCESS tag=prod | eval username=lower(username) | dedup username | table _time username | eval age_days=(now()-_time)/(60*60*24) | where age_days > 30

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try this

sourcetype=webserver audit_event=AUTHN_SUCCESS tag=prod | eval username=lower(username) | dedup username | table _time username | eval age_days=(now()-_time)/(60*60*24) | where age_days > 30

jodros
Builder

Thanks! This worked for me.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...