https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-list-of-users-and-Active-Directory-groups/m-p/339199#M100568 <P>maybe something like this for starters:</P> <PRE><CODE> index=&lt;yourIndex&gt; sourcetype=&lt;youtSourcetype&gt; CN=Schema objectCategory=* | dedup distinguishedName | stats list(cn) by DC OU </CODE></PRE> <P>start with verbose search so you can see all the fields you would like to report on<BR /> also, it is not clear from the question if you are looking for users who use splunk or to all users in your company connected to AD?<BR /> I would assume you are looking for users who are in splunk since you mentioned SAML. If that is the case, probably use @cusello answer above and join results from ad search (here) by the field user <BR /> hope it helps</P> Wed, 19 Apr 2017 18:35:33 GMT adonio 2017-04-19T18:35:33Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-list-of-users-and-Active-Directory-groups/m-p/339195#M100564 <P>Can someone advice on the Splunk search to generate the list of users and associated Active Directory (AD) groups? We are using SAML authentication based on AD groups.</P> <P>Thank you!</P> Wed, 19 Apr 2017 16:21:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-list-of-users-and-Active-Directory-groups/m-p/339195#M100564 mlevsh 2017-04-19T16:21:52Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-list-of-users-and-Active-Directory-groups/m-p/339196#M100565 <P>Hi mlevsh<BR /> try something like this:</P> <PRE><CODE>| rest /services/authentication/users </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Wed, 19 Apr 2017 16:27:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-list-of-users-and-Active-Directory-groups/m-p/339196#M100565 gcusello 2017-04-19T16:27:22Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-list-of-users-and-Active-Directory-groups/m-p/339197#M100566 <P>@cusello Hi Giuseppe, this endpoint shows type of authentication, not the actual AD group</P> Wed, 19 Apr 2017 17:56:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-list-of-users-and-Active-Directory-groups/m-p/339197#M100566 mlevsh 2017-04-19T17:56:25Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-list-of-users-and-Active-Directory-groups/m-p/339198#M100567 <P>I've had pretty good luck using this Splunk app: <A href="https://splunkbase.splunk.com/app/3177/">https://splunkbase.splunk.com/app/3177/</A></P> <P>Allows you to build lookup tables for users, groups, OUs, etc.</P> Wed, 19 Apr 2017 18:10:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-list-of-users-and-Active-Directory-groups/m-p/339198#M100567 jpolcari 2017-04-19T18:10:03Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-list-of-users-and-Active-Directory-groups/m-p/339199#M100568 <P>maybe something like this for starters:</P> <PRE><CODE> index=&lt;yourIndex&gt; sourcetype=&lt;youtSourcetype&gt; CN=Schema objectCategory=* | dedup distinguishedName | stats list(cn) by DC OU </CODE></PRE> <P>start with verbose search so you can see all the fields you would like to report on<BR /> also, it is not clear from the question if you are looking for users who use splunk or to all users in your company connected to AD?<BR /> I would assume you are looking for users who are in splunk since you mentioned SAML. If that is the case, probably use @cusello answer above and join results from ad search (here) by the field user <BR /> hope it helps</P> Wed, 19 Apr 2017 18:35:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-list-of-users-and-Active-Directory-groups/m-p/339199#M100568 adonio 2017-04-19T18:35:33Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-list-of-users-and-Active-Directory-groups/m-p/339200#M100569 <P>You need this app to mine assets from AD</P> <P><A href="https://splunkbase.splunk.com/app/3059/">https://splunkbase.splunk.com/app/3059/</A></P> Wed, 19 Apr 2017 18:47:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-list-of-users-and-Active-Directory-groups/m-p/339200#M100569 woodcock 2017-04-19T18:47:55Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-list-of-users-and-Active-Directory-groups/m-p/339201#M100570 <P>Do you want this to be based on the SAML response? or their full list of AD Groups in Active Directory?</P> Wed, 19 Apr 2017 18:51:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-list-of-users-and-Active-Directory-groups/m-p/339201#M100570 brreeves_splunk 2017-04-19T18:51:00Z