Splunk Search

How to list my splunk admin users list and last login details.

RASHO123
New Member

I have a about 250 Admin users and I would like to to know when was the last time each of them have logged in. Is there a query that I can use

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

This search will look at all the login attempts , but does not contains roles informations.
to get the role /user mapping you need a rest call search.

Remarks :
- remember that they may be more than one role per user
- understand that if a role inherit from the role admin, you will not see it in the list.

index=_audit "action=login attempt" | stats first(_time) AS last_login first(info) AS last_detail by host user | convert ctime(last_login)

So you can add a join after to get the list of roles for each user.

  index=_audit "action=login attempt" | stats first(_time) AS last_login first(info) AS last_detail by host user | convert ctime(last_login) 
  | join user [ |rest /services/authentication/users | fields title roles  |rename title AS user ]

If you want to filter ahead only for members of the admin role, you can try this prefilter condition

 [ |rest /services/authentication/users | fields title roles  |rename title AS user | mvexpand roles |rename roles as role | where role="admin" ] 
index=_audit "action=login attempt" | stats first(_time) AS last_login first(info) AS last_detail by host user 
| convert ctime(last_login) 
| join user [ |rest /services/authentication/users | fields title roles  |rename title AS user ]
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...