https://community.splunk.com/t5/Security/Show-User-s-Full-name-in-Last-Month-Activity/m-p/164981#M4890 <P>Following query gives list of all users-login (field-title) and their full name (field-realname) as specified in the User Profile.</P> <PRE><CODE>| rest /services/authentication/users splunk_server=local | fields title, realname </CODE></PRE> <P>You can join this query in your main search to get the user's full name.</P> Wed, 04 Dec 2013 02:22:47 GMT somesoni2 2013-12-04T02:22:47Z https://community.splunk.com/t5/Security/Show-User-s-Full-name-in-Last-Month-Activity/m-p/164979#M4888 <P>I'd like to show the user's Full name field in the results instead of the login. Is this possible with a simple search?</P> Tue, 03 Dec 2013 21:59:36 GMT https://community.splunk.com/t5/Security/Show-User-s-Full-name-in-Last-Month-Activity/m-p/164979#M4888 andrewkenth 2013-12-03T21:59:36Z https://community.splunk.com/t5/Security/Show-User-s-Full-name-in-Last-Month-Activity/m-p/164980#M4889 <P>Need quite a bit more data here.<BR /><BR /> For starters, what operating system?<BR /> What sourcetype?</P> Wed, 04 Dec 2013 00:00:45 GMT https://community.splunk.com/t5/Security/Show-User-s-Full-name-in-Last-Month-Activity/m-p/164980#M4889 lukejadamec 2013-12-04T00:00:45Z https://community.splunk.com/t5/Security/Show-User-s-Full-name-in-Last-Month-Activity/m-p/164981#M4890 <P>Following query gives list of all users-login (field-title) and their full name (field-realname) as specified in the User Profile.</P> <PRE><CODE>| rest /services/authentication/users splunk_server=local | fields title, realname </CODE></PRE> <P>You can join this query in your main search to get the user's full name.</P> Wed, 04 Dec 2013 02:22:47 GMT https://community.splunk.com/t5/Security/Show-User-s-Full-name-in-Last-Month-Activity/m-p/164981#M4890 somesoni2 2013-12-04T02:22:47Z