https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293782#M88692 <P>Users running more adhoc searches? </P> <P>Users running more schedule searches? </P> <P>Users logging in more times? </P> <P>Users visiting more dashboards? <BR /> @ssievert</P> Wed, 11 Oct 2017 17:08:58 GMT splunker969 2017-10-11T17:08:58Z https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293775#M88685 <P>How can I search top 10 users of splunk ? Any query Help ?? Iam not sure below query is correct ?</P> <P>index=_audit action="success" info=succeeded | stats count by user | sort - count | head 10</P> Wed, 11 Oct 2017 13:28:37 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293775#M88685 splunker969 2017-10-11T13:28:37Z https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293776#M88686 <P>What do you mean by top 10 users? There are different dimension to this.</P> <P>Probably you can combine all of the below to achieve what you are looking at</P> <OL> <LI>Users running more adhoc searches? - audit logs</LI> <LI>Users running more schedule searches? - scheduler logs</LI> <LI>Users logging in more times? - audit logs</LI> <LI>Users visiting more dashboards? - web access logs</LI> </OL> Wed, 11 Oct 2017 13:34:18 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293776#M88686 pradeepkumarg 2017-10-11T13:34:18Z https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293777#M88687 <P>Try Below query </P> <PRE><CODE>| rest /services/authentication/httpauth-tokens splunk_server=local |stats count by userName |sort - count | head 10 </CODE></PRE> <P>It will work</P> Wed, 11 Oct 2017 13:47:14 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293777#M88687 493669 2017-10-11T13:47:14Z https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293778#M88688 <P>Can you please help me with query @gpradeepkumararreddy</P> Wed, 11 Oct 2017 13:50:22 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293778#M88688 splunker969 2017-10-11T13:50:22Z https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293779#M88689 <P>Thanks @493669 .Since i am looking for above @ @gpradeepkumararreddy mentioned .The query that you sent will help to check which splunk servers user are logging .Thanks for the query <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 11 Oct 2017 14:28:53 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293779#M88689 splunker969 2017-10-11T14:28:53Z https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293780#M88690 <P>@somesoni2 any help ?</P> Wed, 11 Oct 2017 15:21:40 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293780#M88690 splunker969 2017-10-11T15:21:40Z https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293781#M88691 <P>Is the <A href="http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Top">top command</A> what you are looking for?</P> Wed, 11 Oct 2017 17:00:49 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293781#M88691 s2_splunk 2017-10-11T17:00:49Z https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293782#M88692 <P>Users running more adhoc searches? </P> <P>Users running more schedule searches? </P> <P>Users logging in more times? </P> <P>Users visiting more dashboards? <BR /> @ssievert</P> Wed, 11 Oct 2017 17:08:58 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-search-top-10-users-of-splunk/m-p/293782#M88692 splunker969 2017-10-11T17:08:58Z