Forum Discussion

miles_cross's avatar
miles_cross
Icon for Contributor rankContributor
3 months ago

Find last login time for user accounts using API

Hi - Where would a person find the last login time for accounts that login with the API?  I have checked Access Sessions and the report Inactive User and the API sessions do not get logged.  I am not able to load Audit Logs without a timeout to see if the API sessions would be available there.

Thanks

 

sl1
  • chris_thornton's avatar
    chris_thornton
    3 months ago

    Others have said it is not possible via the API, but that information is available via a GQL query if you are familiar with that. It would return the UNIX epoch time for their last login in the results, which can easily be converted with some programming. Let me know if you would like some more details on it. Here is a simple query you can run by going to https://{yourSL1URL}/gql

    {
  accounts{
    edges{
      node{
        id
        user
        lastLoginTime
      }
    }
  }
}


    This only returns the first 10 results by default, and there are some search options you can do with it as well. Lots of fun stuff with it really.

     

  • jamesramsden's avatar
    jamesramsden
    Icon for Contributor III rankContributor III
    3 months ago

    I don't think you can get that from the API, 

    Only these are available for a user account. 

      "fields": [
            "_id",
            "active",
            "address",
            "admin",
            "all_orgs",
            "autodetect_timezone",
            "barred",
            "billing_id",
            "cell",
            "city",
            "codehighlight",
            "console_height",
            "contact_fname",
            "contact_lname",
            "country",
            "create_date",
            "created_by",
            "critical",
            "crm_id",
            "date_format",
            "default_map",
            "default_map_type",
            "dept",
            "dev_html5_graph",
            "edit_date",
            "email",
            "email_2",
            "email_3",
            "event_severity",
            "events_beta",
            "events_collapse_orgs",
            "events_default_view",
            "events_show_masked",
            "fax",
            "graph_scale_to_100",
            "if_graph_perc",
            "iflabel_pref",
            "im",
            "im_type",
            "is_email_select",
            "ldap",
            "login_state",
            "mf_user",
            "navbar_autohide_disabled",
            "network_hide_empty",
            "notes",
            "office",
            "organization",
            "page_results",
            "pager",
            "passwd_expiration",
            "passwd_prev_count",
            "passwd_reset_required",
            "passwd_set_date",
            "passwd_strength",
            "phone",
            "recent_timezone",
            "refresh",
            "resource_id",
            "restrict_ip",
            "role",
            "show_severity_badges",
            "state",
            "table_row_height",
            "theme",
            "ticket_comment_cloaking",
            "ticket_note_sort",
            "ticket_view_assigned_only",
            "timezone",
            "title",
            "tollfree",
            "updated_by",
            "user",
            "user_policy",
            "userdisplayname",
            "userprincipalname",
            "verification_answer",
            "verification_question",
            "zip"

     

  • TonyAndres's avatar
    TonyAndres
    Icon for Moderator rankModerator
    3 months ago

    Hello Miles,

    To determine the last time a user logged in, you would either need to view the Access or Audit logs. Unfortunately, neither of these are accessible from the API. You can request for the API to gain access to the Access and Audit logs via our Ideas Hub here in the community.

    Regards,

    Antonio Andres

    Senior Technical Support Engineer | ScienceLogic

  • chris_thornton's avatar
    chris_thornton
    Icon for Contributor III rankContributor III
    3 months ago

    Others have said it is not possible via the API, but that information is available via a GQL query if you are familiar with that. It would return the UNIX epoch time for their last login in the results, which can easily be converted with some programming. Let me know if you would like some more details on it. Here is a simple query you can run by going to https://{yourSL1URL}/gql

    {
  accounts{
    edges{
      node{
        id
        user
        lastLoginTime
      }
    }
  }
}


    This only returns the first 10 results by default, and there are some search options you can do with it as well. Lots of fun stuff with it really.