https://community.splunk.com/t5/Splunk-Search/Can-someone-tell-me-how-to-count-users-by-index-please/m-p/126983#M34412 <P>I was trying to keep track of how many users have access to each index. Any help would be much appreciated. </P> Mon, 27 Jan 2014 20:23:55 GMT Rlemana 2014-01-27T20:23:55Z https://community.splunk.com/t5/Splunk-Search/Can-someone-tell-me-how-to-count-users-by-index-please/m-p/126983#M34412 <P>I was trying to keep track of how many users have access to each index. Any help would be much appreciated. </P> Mon, 27 Jan 2014 20:23:55 GMT https://community.splunk.com/t5/Splunk-Search/Can-someone-tell-me-how-to-count-users-by-index-please/m-p/126983#M34412 Rlemana 2014-01-27T20:23:55Z https://community.splunk.com/t5/Splunk-Search/Can-someone-tell-me-how-to-count-users-by-index-please/m-p/126984#M34413 <P>This should do the trick:</P> <PRE><CODE>| rest /services/authentication/users | table title roles | mvexpand roles | join max=0 type=left roles [rest /services/authorization/roles | table title srchIndexesAllowed | rename title as roles | mvexpand srchIndexesAllowed] | stats dc(title) by srchIndexesAllowed </CODE></PRE> <P>You'll see values for srchIndexesAllowed of "*" and "_*", those mean "all non-internal indexes" and "all internal indexes" respectively.</P> Mon, 27 Jan 2014 21:51:04 GMT https://community.splunk.com/t5/Splunk-Search/Can-someone-tell-me-how-to-count-users-by-index-please/m-p/126984#M34413 martin_mueller 2014-01-27T21:51:04Z