https://community.splunk.com/t5/Splunk-Search/how-to-search-for-user-id-s-and-any-information-that-splunk-has/m-p/704512#M238710 <P>we have a user ID that we are looking to find out what splunk has collected.&nbsp; what is the serach that i use?</P> Fri, 15 Nov 2024 14:30:05 GMT mg99 2024-11-15T14:30:05Z https://community.splunk.com/t5/Splunk-Search/how-to-search-for-user-id-s-and-any-information-that-splunk-has/m-p/704512#M238710 <P>we have a user ID that we are looking to find out what splunk has collected.&nbsp; what is the serach that i use?</P> Fri, 15 Nov 2024 14:30:05 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-for-user-id-s-and-any-information-that-splunk-has/m-p/704512#M238710 mg99 2024-11-15T14:30:05Z https://community.splunk.com/t5/Splunk-Search/how-to-search-for-user-id-s-and-any-information-that-splunk-has/m-p/704515#M238711 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/274073">@mg99</a>&nbsp;,</P><P>your request isn't so clear, could you better detail it?</P><P>If you want to know which information you have, you could run a search that extract the list of sourcetypes:</P><LI-CODE lang="markup">index=* | stats values(host) AS host values(index) AS index count BY sourcetype</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Fri, 15 Nov 2024 14:44:17 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-for-user-id-s-and-any-information-that-splunk-has/m-p/704515#M238711 gcusello 2024-11-15T14:44:17Z