All Apps and Add-ons

In the Splunk App for UNIX/Linux, how do I check to see if a user is locked or is not in Splunk?

Path Finder

We have Splunk app for UNIX/Linux installed which we use for different purpose.

Currently I am looking for a way to check if a user is locked or not in Splunk, however there is not a field which seems to be useful to find that out.

Can someone assist with this please?

Tags (1)
0 Karma


Perhaps you could use an ldap query against AD via the ldap search command rather than the nix add on if your users are in a Windows Active Directory.

0 Karma



Are you looking after Unix/Linux server level user checking whether user is locked or not on server and not looking after Splunk application user locked ? In this case you need to create custom script for Unix/Linux server to check whether user is locked or not and run at certain interval on all Unix/Linux servers and ingest those data into Splunk and then create Splunk query based on your requirement.

To run script on Universal Forwarder, you need to use [script://.....] stanza in inputs.conf

0 Karma

Super Champion

If You are an admin and you want to check if certain user is locked or not then go to Settings>>Access Control>>Users and see if particular user is locked or not ..if it is locked then you will see unlock user option.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!