https://community.splunk.com/t5/Security/logged-in-users/m-p/216723#M6132 <P>Hi at all,<BR /> I'd like to identify Splunk currently and/or today's logged users.<BR /> Using <CODE>| rest /services/authentication/current-context splunk_server=local | rename username AS user | table user realname roles</CODE> I can identify the logged users; and using <CODE>index=_audit NOT (user="n/a" OR user="splunk-system-user" OR "scheduler__nobody__search" OR "admin" OR "nobody") NOT "REST" NOT scheduler | join type=left user [| rest /services/authentication/current-context splunk_server=local | rename username AS user | table user realname roles ] | transaction user</CODE> I can identify today's logged users.</P> <P>My problem is to identify when users was logged in because I have Splunk configured in SSO with an external authentication system so I cannot find <CODE>action="login attempt"</CODE> (that I usually find in _audit index to understand that a user is logged in).<BR /> Someone has an idea how to have the time session of a Splunk user when there is a SSO authentication?</P> <P>Bye.<BR /> Giuseppe</P> Fri, 30 Dec 2016 15:07:28 GMT gcusello 2016-12-30T15:07:28Z https://community.splunk.com/t5/Security/logged-in-users/m-p/216723#M6132 <P>Hi at all,<BR /> I'd like to identify Splunk currently and/or today's logged users.<BR /> Using <CODE>| rest /services/authentication/current-context splunk_server=local | rename username AS user | table user realname roles</CODE> I can identify the logged users; and using <CODE>index=_audit NOT (user="n/a" OR user="splunk-system-user" OR "scheduler__nobody__search" OR "admin" OR "nobody") NOT "REST" NOT scheduler | join type=left user [| rest /services/authentication/current-context splunk_server=local | rename username AS user | table user realname roles ] | transaction user</CODE> I can identify today's logged users.</P> <P>My problem is to identify when users was logged in because I have Splunk configured in SSO with an external authentication system so I cannot find <CODE>action="login attempt"</CODE> (that I usually find in _audit index to understand that a user is logged in).<BR /> Someone has an idea how to have the time session of a Splunk user when there is a SSO authentication?</P> <P>Bye.<BR /> Giuseppe</P> Fri, 30 Dec 2016 15:07:28 GMT https://community.splunk.com/t5/Security/logged-in-users/m-p/216723#M6132 gcusello 2016-12-30T15:07:28Z https://community.splunk.com/t5/Security/logged-in-users/m-p/216724#M6133 <P>Hi cusello,</P> <P>a long time ago I wrote this answer <A href="https://answers.splunk.com/answers/107574/track-users-logging-in-via-sso.html">https://answers.splunk.com/answers/107574/track-users-logging-in-via-sso.html</A> maybe it helps you as well.</P> <P>cheers, MuS</P> Fri, 06 Jan 2017 06:21:09 GMT https://community.splunk.com/t5/Security/logged-in-users/m-p/216724#M6133 MuS 2017-01-06T06:21:09Z