Splunk Search

User last login date

sanju005ind
Communicator

I have a about 250 users and I would like to to know when was the last time each of them have logged in. Is there a query that I can use.

Tags (1)
1 Solution

wollinet
Path Finder

Try

index=_audit action="login attempt" | stats max(timestamp) by user

View solution in original post

chrisitanmoleck
Path Finder

The answer of wollinet works only for the current year, because the timestamp is mm-dd-yy.
So if you did login in December 2016 and January 2017, the last login will be December 2016.

Is it possible to modify the query that the order is yy-mm-dd?

0 Karma

bjoernhansen
Path Finder

Should be like this:
iindex=_audit action="login attempt" | stats latest(user) by user

It should actually not matter what you put inside the latest()...

0 Karma

wollinet
Path Finder

Try

index=_audit action="login attempt" | stats max(timestamp) by user

sanju005ind
Communicator

That works! Thanks a lot.

0 Karma

stanwin
Contributor

action="login attempt" is not logged for 6.2.2 it seems..

works for 6.1.4 Build 233537

0 Karma

marcospmr
Explorer

It works ok for 6.3.

0 Karma

sanju005ind
Communicator

They are splunk users. I would like to know when each user last logged in Splunk.

0 Karma

ftk
Motivator

Can you elaborate a bit please? Are they splunk users and you want to look at splunk's audit logs or are they users in a different system? If they are a different system, what system, how do you get the logs, can you provide sample data?

You'll get a better answer the more detail you provide.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...