The only way I can see doing this is to create an Extension Attribute that would get the last login value time and drop that into a result formatted so Jamf Pro can use it as a Date formatted EA, and then build your Smart Group from there.
You could use the last command to do this, but, last has an issue in that the date it stores is not really ideal since it doesn't include all required information. It shows a day, month, date and time, but no year for some inexplicable reason. Generally speaking this isn't a problem, but I can foresee scenarios where results can get a little weird, like just after the start of a new year, because you would have to assume the missing year from the last command is the current one and it may not always be.
A better approach might be to have a persistent login triggered policy (even cached locally so it runs offline) that just captures the date of last login (and maybe the username) on each login into a local file, then have the EA pick up that value later. For example, script for the login policy
#!/bin/bash
PLIST="/Library/Preferences/LastLoginValue.plist"
sleep 5
loggedInUser=$(stat -f%Su /dev/console)
loginTime=$(date +"%Y-%m-%d %H:%M:%S")
/usr/bin/defaults write "$PLIST" LastUser "$loggedInUser"
/usr/bin/defaults write "$PLIST" LastLoginTime "$loginTime"
Then for the EA script, something like this:
#!/bin/bash
PLIST="/Library/Preferences/LastLoginValue.plist"
LastLoginTime=$(/usr/bin/defaults read "$PLIST" LastLoginTime 2>/dev/null)
if [ ! -z "$LastLoginTime" ]; then
result="$LastLoginTime"
else
result="1970-01-01 00:00:00"
fi
echo "<result>$result</result>"
Using the above, you'll get results like
2018-04-01 10:05:34
The EA should be set up as a Date formatted EA, then you can build Smart Groups that use it with options like more than x days ago or less than x days ago
Hope that helps.
