Splunk Search

Inactive Users

williamdicker
New Member

Hello Splunk,

I am attempting to write a query that searches Splunk for any users that have not logged in for the past 60 days. This is a compliance requirement and all query's are not working.

Our login sourcetype is sam:xml

My latest search resulted in zero events:

index=_internal source=*web_service.log action=login status=success | eval last_login_time=_time | eval current_time=now() | eval time_since_last_login_secs=current_time-last_login_time | where time_since_last_login_secs > 2592000 | table user

Tags (3)
0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@williamdicker - Did the answer provided by naidusadanala help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

naidusadanala
Communicator

Try this

index=_audit action="login attempt" info=succeeded |stats max(timestamp) as last_login_time by user | eval last_login_time = strptime('last_login_time', "%m-%d-%Y %H:%M:%S")
| eval current_time=now() | eval time_since_last_login_secs=current_time-last_login_time | where time_since_last_login_secs > 2592000 | table user

adonio
Ultra Champion

very good here!
for 60 days change 2592000 (this is 30 days) to 5184000

0 Karma

naidusadanala
Communicator

You are right

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...