Splunk Search

subsearch question

Phynyte
New Member

I'm trying to pull a list of the last time User Accounts logged. The part I need help on is the following.I'm looking for a finite list of User Accounts. This list is pulled from a csv file that was loaded.

Then from that list I'm looking at all of the successful logons from an index and I just want the time/User Account of the last logon from that user.

index=security "An account was successfully logged on." [search index=randomlogs host=useraccountlist | table UsrAcctName | fields + UsrAcctName]

I got the subsearch down but how do I use the results returned from the subsearch in my outer search to pull the _time and UsrAcctName?

The UsrAcctName I use in the inner search is called Account_Name in the search in the security index. So do I need to define this somewhere?

Any help would be appreciated.

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi Phynyte,

this is un-tested, but you can try something like this:

index=security "An account was successfully logged on." [ search index=randomlogs host=useraccountlist | rename UsrAcctName AS Account_Name | return Account_Name ]

_time will be returned from your events from the outer search.

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi Phynyte,

this is un-tested, but you can try something like this:

index=security "An account was successfully logged on." [ search index=randomlogs host=useraccountlist | rename UsrAcctName AS Account_Name | return Account_Name ]

_time will be returned from your events from the outer search.

hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...