https://community.splunk.com/t5/Splunk-Search/How-to-get-list-of-users-for-specific-search-How-to-get-list-of/m-p/497078#M194758 <P><CODE>when ...</CODE><BR /> Are you going to make alert?</P> <P><CODE>rex</CODE> is no problem.</P> Thu, 14 May 2020 17:37:56 GMT to4kawa 2020-05-14T17:37:56Z https://community.splunk.com/t5/Splunk-Search/How-to-get-list-of-users-for-specific-search-How-to-get-list-of/m-p/497075#M194755 <P>Hi All,</P> <P>I am very new to splunk, wanted to get the list unique users for below criteria.</P> <P>I need query to get the actor which was a user .</P> <P>Unable to retrieve the content 7ec12461-b0db-4a7b-a210-7da0b2a1542e ph924_8bc4e8a6-6tr-oipo-zcvv-ea281ba6b101 Actor raja.<BR /> Unable to retrieve the content 7ec12461-b0db-4a7b-a210-7da0b2a1542e ph924_8bc4e8a6-950f-rtey-ggff-qwrq42342435 Actor shekar.<BR /> Unable to retrieve the content 7ec12461-b0db-4a7b-a210-7da0b2a1542e ph924_8bc4e8a6-khj-4ce6-khjk-gdgdfshghgfg Actor Madhu.,</P> Wed, 30 Sep 2020 05:24:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-list-of-users-for-specific-search-How-to-get-list-of/m-p/497075#M194755 rajawccm16 2020-09-30T05:24:45Z https://community.splunk.com/t5/Splunk-Search/How-to-get-list-of-users-for-specific-search-How-to-get-list-of/m-p/497076#M194756 <PRE><CODE>index=yours sourcetype=yours | rex "Actor (?&lt;user&gt;\S+)" | stats values(user) as unique_users_list </CODE></PRE> <P>references:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex</A><BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats</A></P> <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial">https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial</A><BR /> <A href="https://www.splunk.com/en_us/training/courses/splunk-fundamentals-1.html">https://www.splunk.com/en_us/training/courses/splunk-fundamentals-1.html</A></P> Thu, 14 May 2020 07:27:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-list-of-users-for-specific-search-How-to-get-list-of/m-p/497076#M194756 to4kawa 2020-05-14T07:27:03Z https://community.splunk.com/t5/Splunk-Search/How-to-get-list-of-users-for-specific-search-How-to-get-list-of/m-p/497077#M194757 <P>Thank you for ur reply</P> <P>when "exception: Error occurred. Unable to retrieve document, please contact the helpdesk." occurred,</P> <P>then need to get actor from message section, Please advise</P> <P>exception: Error occurred. Unable to retrieve document, please contact the helpdesk.<BR /> logger: com.web.controller.DocumentController<BR /> message: 2020-05-14T13:12:47.753Z [taskExecutor-50] ui-prd-140-wttsz UI<BR /> ERROR c.o.d.d.w.c.DocumentController:-1 - Unable to retrieve the content for source Actor Raja.<BR /> com..exception.DocumentNotFoundException: Error occurred. Unable to retrieve document, please contact the helpdesk.<BR /> at com.web.controller.DocumentController$1$4.extractData(Unknown Source)<BR /> at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:662)<BR /> at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:635)<BR /> at com.web.controller.DocumentController$1.call(Unknown Source)<BR /> at com..web.controller.DocumentController$1.call(Unknown Source)<BR /> at org.springframework.web.context.request.async.WebAsyncManager$5.run(WebAsyncManager.java:327)<BR /> at co.elastic.apm.agent.impl.async.SpanInScopeRunnableWrapper.run(SpanInScopeRunnableWrapper.java:64)<BR /> at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)<BR /> at java.util.concurrent.FutureTask.run(FutureTask.java:266)<BR /> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)<BR /> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)<BR /> at java.lang.Thread.run(Thread.java:748)<BR /> Caused by: java.lang.NullPointerException: null</P> Thu, 14 May 2020 13:17:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-list-of-users-for-specific-search-How-to-get-list-of/m-p/497077#M194757 rajawccm16 2020-05-14T13:17:16Z https://community.splunk.com/t5/Splunk-Search/How-to-get-list-of-users-for-specific-search-How-to-get-list-of/m-p/497078#M194758 <P><CODE>when ...</CODE><BR /> Are you going to make alert?</P> <P><CODE>rex</CODE> is no problem.</P> Thu, 14 May 2020 17:37:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-list-of-users-for-specific-search-How-to-get-list-of/m-p/497078#M194758 to4kawa 2020-05-14T17:37:56Z