https://community.splunk.com/t5/Monitoring-Splunk/Splunk-query-to-get-the-list-of-users-using-api-to-get-the-data/m-p/566109#M8558 <P>Hi All,</P><P>&nbsp;</P><P>I want to get list of users using the splunk api&nbsp;to get the data from splunk, can you please guide how we can do that.</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 07 Sep 2021 10:41:21 GMT rahulbhatia 2021-09-07T10:41:21Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-query-to-get-the-list-of-users-using-api-to-get-the-data/m-p/566109#M8558 <P>Hi All,</P><P>&nbsp;</P><P>I want to get list of users using the splunk api&nbsp;to get the data from splunk, can you please guide how we can do that.</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 07 Sep 2021 10:41:21 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-query-to-get-the-list-of-users-using-api-to-get-the-data/m-p/566109#M8558 rahulbhatia 2021-09-07T10:41:21Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-query-to-get-the-list-of-users-using-api-to-get-the-data/m-p/566293#M8559 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/44636">@rahulbhatia</a>&nbsp;</P><P>Try this base query uri_path field contains api, user field having user details. Do you know the api you want to find in then filter them</P><LI-CODE lang="markup">index=_internal source="/opt/splunk/var/log/splunk/splunkd_access.log" sourcetype=splunkd_access | table _time user uri_path output_mode</LI-CODE><P>--</P><P>an upvote would be appreciated if this reply helps!</P><P>&nbsp;</P> Wed, 08 Sep 2021 11:51:56 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-query-to-get-the-list-of-users-using-api-to-get-the-data/m-p/566293#M8559 venkatasri 2021-09-08T11:51:56Z