https://community.splunk.com/t5/Security/disabled-user-list/m-p/328997#M8436 <P>do you mean inactive users?</P> <PRE><CODE> | rest /services/authentication/users splunk_server=local | fields realname, title | rename title as user | join user type=left [ | search index=_audit action="login attempt" earliest=-12mon | stats max(timestamp) as _time by user, sourcetype ] | where isnull(sourcetype) | fields - sourcetype </CODE></PRE> <P>Also, have a look at this answer<BR /> <A href="https://answers.splunk.com/answers/481/search-for-inactive-splunk-users.html">https://answers.splunk.com/answers/481/search-for-inactive-splunk-users.html</A></P> <P>let me know if this helps!</P> Sat, 27 Jan 2018 09:13:32 GMT mayurr98 2018-01-27T09:13:32Z https://community.splunk.com/t5/Security/disabled-user-list/m-p/328996#M8435 <P>how to get list of disabled users in splunk ? any query ?</P> <P>i was checking for orphaned object query :</P> <P>| rest timeout=600 splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0 <BR /> | search orphan=1</P> <P>does it help ?</P> Tue, 29 Sep 2020 17:48:44 GMT https://community.splunk.com/t5/Security/disabled-user-list/m-p/328996#M8435 Mohsin123 2020-09-29T17:48:44Z https://community.splunk.com/t5/Security/disabled-user-list/m-p/328997#M8436 <P>do you mean inactive users?</P> <PRE><CODE> | rest /services/authentication/users splunk_server=local | fields realname, title | rename title as user | join user type=left [ | search index=_audit action="login attempt" earliest=-12mon | stats max(timestamp) as _time by user, sourcetype ] | where isnull(sourcetype) | fields - sourcetype </CODE></PRE> <P>Also, have a look at this answer<BR /> <A href="https://answers.splunk.com/answers/481/search-for-inactive-splunk-users.html">https://answers.splunk.com/answers/481/search-for-inactive-splunk-users.html</A></P> <P>let me know if this helps!</P> Sat, 27 Jan 2018 09:13:32 GMT https://community.splunk.com/t5/Security/disabled-user-list/m-p/328997#M8436 mayurr98 2018-01-27T09:13:32Z