All Apps and Add-ons

App/User Role with the highest number of queries running or running

Path Finder


I'm trying to perform a search that shows me a list of top apps / roles that most perform queries. I'm trying to hold rest queries to get this information but I'm not getting it.

Someone has a suggestion?


0 Karma


Hi @markuxProof

Splunk writes data about top apps, top users in Introspection Index

Hope this helps,

alt text


0 Karma

Splunk Employee
Splunk Employee

For the search per app you can easily tell from the monitoring console app.


the panels are populated by searches based on introspection. (it has the type of search, app, user, mode , search name...)
but the role is not included, you may have to do a lookup (for the user/role mapping), but remember that an user can be member of several roles, and that roles inherit from each others, so you may not have a 1-1 relation ....

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>