Determining User Last Login Date

RE: Determining User Last Login Date

germand519 — Thu, 29 Jan 2026 12:17:54 GMT

You have to retrive data from the 3 nodes and union them later

/* Logs nodo 1 */
  local!filesToRetrieveNode1: a!forEach(
    items: local!datesToRetrieve,
    expression: concat(
      "app-jboss-1/login-audit.csv.",
      fv!item
    )
  ),
  local!validFilesToRetrieveNode1: a!forEach(
    items: local!filesToRetrieveNode1,
    expression: if(
      todate(
        index(
          getloginfo(logPath: fv!item),
          "lastModified",
          {}
        )
      ) > date(2000, 1, 1),
      fv!item,
      {}
    )
  ),
  /* Logs Nodo 2*/
  local!filesToRetrieveNode2: a!forEach(
    items: local!datesToRetrieve,
    expression: concat(
      "app-jboss-2/login-audit.csv.",
      fv!item
    )
  ),
  local!validFilesToRetrieveNode2: a!forEach(
    items: local!filesToRetrieveNode2,
    expression: if(
      todate(
        index(
          getloginfo(logPath: fv!item),
          "lastModified",
          {}
        )
      ) > date(2000, 1, 1),
      fv!item,
      {}
    )
  ),
  /* Logs Nodo 3*/
  local!filesToRetrieveNode3: a!forEach(
    items: local!datesToRetrieve,
    expression: concat(
      "app-jboss-3/login-audit.csv.",
      fv!item
    )
  ),
  local!validFilesToRetrieveNode3: a!forEach(
    items: local!filesToRetrieveNode3,
    expression: if(
      todate(
        index(
          getloginfo(logPath: fv!item),
          "lastModified",
          {}
        )
      ) > date(2000, 1, 1),
      fv!item,
      {}
    )
  ),
  local!validFilesToRetrieveAllNodes: union(
    "app-jboss-1/login-audit.csv.",
    local!validFilesToRetrieveNode1,
    "app-jboss-2/login-audit.csv.",
    local!validFilesToRetrieveNode2,
    "app-jboss-3/login-audit.csv.",
    local!validFilesToRetrieveNode3
  ),

RE: Determining User Last Login Date

michaelnyefda — Tue, 08 Jul 2025 19:50:30 GMT

marius-cristian001 I figured out the problem. This code block above does not properly cast dates so when it interprets June 30th, it views it as the 6th day of the 30th month, which leads to a casting error and causes the day to be dropped as shown in your screenshot

You no longer have this issue if you update it to:

a!localVariables(
local!loginAuditDaysToRetrieve: 40,
local!numberOfDaysToRetrieve: 1 + enumerate(local!loginAuditDaysToRetrieve),
local!datesToRetrieve: a!forEach(
items: local!numberOfDaysToRetrieve,
expression: text(
todate(local(now())) - fv!index,
"yyyy-mm-dd"
)
),
local!filesToRetrieve: a!forEach(
items: local!datesToRetrieve,
expression: concat(
"login-audit.csv.",
fv!item
)
),
local!validFilesToRetrieve: a!forEach(
items: local!filesToRetrieve,
expression: if(
todate(
index(
getloginfo(
logPath: fv!item
),
"lastModified",
{}
)
) > date(2000,1,1),
fv!item,
{}
)
),
local!loginAuditAsText: reject(
fn!isnull,
a!flatten(
a!forEach(
items: local!validFilesToRetrieve,
expression: a!localVariables(
local!loginAuditFromCsv: readcsvlog(
csvPath: fv!item
),
local!headers: index(
local!loginAuditFromCsv,
"headers",
{}
),
local!rows: index(
local!loginAuditFromCsv,
"rows",
{}
),
{
joinarray(local!headers,","),
local!rows
}
)
)
)
),
local!loginAudit: a!forEach(
items: local!loginAuditAsText,
expression: a!localVariables(
local!loginAuditArray: split(fv!item, ","),
local!rawLoggedIn: index(
local!loginAuditArray,
1,
{}
),
local!rawLoggedInSplit: split(
local!rawLoggedIn,
" "
),
local!rawLoggedInDate: index(
local!rawLoggedInSplit,
1,
{}
),
local!convertedLoggedInDate:
joinarray(
reverse(
split(
local!rawLoggedInDate,
"-"
)
),
"/"
),
local!rawLoggedInTime: split(
index(
local!rawLoggedInSplit,
2,
{}
),
":"
),
local!convertedLoggedInTime: time(
index(
local!rawLoggedInTime,
1,
{}
),
index(
local!rawLoggedInTime,
2,
{}
),
index(
local!rawLoggedInTime,
3,
{}
)
),
local!finalLoggedIn: rule!APPN_reverseMonthAndDayOfDate(local!convertedLoggedInDate) + local!convertedLoggedInTime,
{
username: index(
local!loginAuditArray,
2,
{}
),
loggedIn: local!finalLoggedIn,
loggedInDate: local!convertedLoggedInDate,
loggedInTime: local!convertedLoggedInTime,
outcome: index(
local!loginAuditArray,
3,
{}
)
}
)
),
reject(
fn!isnull,
union(
local!loginAudit,
local!loginAudit
)
)
)

where APPN_reverseMonthAndDayOfDate has the expression:

joinarray(
index(
split(
ri!date,
"/"
),
{2,1,3},
{}
),
"/"
)

RE: Determining User Last Login Date

sridhart4969 — Thu, 03 Jul 2025 19:32:53 GMT

On Prod we have 3 servers.

suite/shared-logs/app-jboss-1/
suite/shared-logs/app-jboss-2/
suite/shared-logs/app-jboss-3/

How to pass csvPath to above server paths.

readcsvlog function says csvPath (Text): Path to the csv log file (relative to the /logs directory)

RE: Determining User Last Login Date

ajhick — Thu, 17 Mar 2022 09:26:04 GMT

I'm not having this issue. If you're using the same local variable names as me can you check your raw output from one of the valid files to retrieve? See the below code and look in the "rows" index at the left hand side (before the first comma) to check the format of the dates that are in your login audit files.

Preferably make it so you can look at one of the entries where it's only giving the time!

a!localVariables(
  local!numberOfDaysToRetrieve: 1 + enumerate(90),
  local!datesToRetrieve: a!forEach(
    items: local!numberOfDaysToRetrieve,
    expression: text(
      todate(local(now())) - fv!index,
      "yyyy-mm-dd"
    )
  ),
  local!filesToRetrieve: a!forEach(
    items: local!datesToRetrieve,
    expression: concat(
      "login-audit.csv.",
      fv!item
    )
  ),
  local!validFilesToRetrieve: a!forEach(
    items: local!filesToRetrieve,
    expression: if(
      todate(
        index(
          getloginfo(
            logPath: fv!item
          ),
          "lastModified",
          {}
        )
      ) > date(2000,1,1),
      fv!item,
      {}
    )
  )[1], /*Manipulate this index to try and get an instance where only a time is showing*/
  local!loginAuditAsText: reject(
    fn!isnull,
    a!flatten(
      a!forEach(
        items: local!validFilesToRetrieve,
        expression: a!localVariables(
          local!loginAuditFromCsv: readcsvlog(
            csvPath: fv!item
          ),
          local!loginAuditFromCsv
        )
      )
    )
  ),
  local!loginAuditAsText
)

RE: Determining User Last Login Date

Stewart Burchell — Wed, 16 Mar 2022 15:51:48 GMT

Have you looked at the raw output in the Expression Rule designer? Just wondering if Appian is rendering the time when the date happens to be today...if the raw data is the same then it must be the Log Reader doing the same...in which case you can infer that the date is today if you only have the time

RE: Determining User Last Login Date

marius-cristian001 — Wed, 16 Mar 2022 15:41:23 GMT

Hi,

We have installed the Log Reader Plugin and used your code.
In some cases some lines are returned without the entire log date.

I already checked the entire code but i couldn't find the root cause for the issue.

Do you have any suggestion on how to fix this?

Thank you!

RE: Determining User Last Login Date

Barthe — Tue, 01 Mar 2022 14:39:04 GMT

Thank you ajhick, I will take a look at your code. Thanks for sharing!

RE: Determining User Last Login Date

ajhick — Fri, 25 Feb 2022 22:21:15 GMT

Hi Barthe,

The below code does required the Log Reader plugin but it produces a list of logins for the login files. I don't know if this is the best way but this is what I've been using. I do a fair amount of transformation on this data but this is the core.

https://community.appian.com/b/appmarket/posts/log-reader

a!localVariables(
  local!loginAuditDaysToRetrieve: 90,
  local!numberOfDaysToRetrieve: 1 + enumerate(local!loginAuditDaysToRetrieve),
  local!datesToRetrieve: a!forEach(
    items: local!numberOfDaysToRetrieve,
    expression: text(
      todate(local(now())) - fv!index,
      "yyyy-mm-dd"
    )
  ),
  local!filesToRetrieve: a!forEach(
    items: local!datesToRetrieve,
    expression: concat(
      "login-audit.csv.",
      fv!item
    )
  ),
  local!validFilesToRetrieve: a!forEach(
    items: local!filesToRetrieve,
    expression: if(
      todate(
        index(
          getloginfo(
            logPath: fv!item
          ),
          "lastModified",
          {}
        )
      ) > date(2000,1,1),
      fv!item,
      {}
    )
  ),
  local!loginAuditAsText: reject(
    fn!isnull,
    a!flatten(
      a!forEach(
        items: local!validFilesToRetrieve,
        expression: a!localVariables(
          local!loginAuditFromCsv: readcsvlog(
            csvPath: fv!item
          ),
          local!headers: index(
            local!loginAuditFromCsv,
            "headers",
            {}
          ),
          local!rows: index(
            local!loginAuditFromCsv,
            "rows",
            {}
          ),
          {
            joinarray(local!headers,","),
            local!rows
          }
        )
      )
    )
  ),
  local!loginAudit: a!forEach(
    items: local!loginAuditAsText,
    expression: a!localVariables(
      local!loginAuditArray: split(fv!item, ","),
      local!rawLoggedIn: index(
        local!loginAuditArray,
        1,
        {}
      ),
      local!rawLoggedInSplit: split(
        local!rawLoggedIn,
        " "
      ),
      local!rawLoggedInDate: index(
        local!rawLoggedInSplit,
        1,
        {}
      ),
      local!convertedLoggedInDate: joinarray(
        reverse(
          split(
            local!rawLoggedInDate,
            "-"
          )
        ),
        "/"
      ),
      local!rawLoggedInTime: split(
        index(
          local!rawLoggedInSplit,
          2,
          {}
        ),
        ":"
      ),
      local!convertedLoggedInTime: time(
        index(
          local!rawLoggedInTime,
          1,
          {}
        ),
        index(
          local!rawLoggedInTime,
          2,
          {}
        ),
        index(
          local!rawLoggedInTime,
          3,
          {}
        )
      ),
      local!finalLoggedIn: local!convertedLoggedInDate + local!convertedLoggedInTime,
      {
        username: index(
          local!loginAuditArray,
          2,
          {}
        ),
        loggedIn: local!finalLoggedIn,
        outcome: index(
          local!loginAuditArray,
          3,
          {}
        )
      }
    )
  ),
  reject(
    fn!isnull,
    union(
      local!loginAudit,
      local!loginAudit
    )
  )
)