Archive
Highlighted

How to list user accounts with domain?

Explorer

Hi,

Splunk Enterprise.

I am trying to get the list of all user accounts using below code, but the result showing only Splunk console users list instead of all Active Directory User Account List.

Code:

| rest splunk_server=local /servicesNS/-/-/authentication/users count=0 | table title email real name type

Output

Admin admin@xyz.com administrator splunk
babu babu@xyz.com babu LDAP

like this result is showing only 10 lines, all these are splunk console users. I dont know why all Active Directory User Accounts not showing.

Could anyone help me & guide me on this.

Thanks in advance.

0 Karma
Highlighted

Re: How to list user accounts with domain?

Ultra Champion

From that same searchhead, can you see the LDAP users if you go to your_sh:8000/en-GB/manager/search/authentication/users

0 Karma
Highlighted

Re: How to list user accounts with domain?

Explorer

please give me the full code.

0 Karma
Highlighted

Re: How to list user accounts with domain?

Ultra Champion

I mean in a browser go to http(s)://your_splunk_search_head:8000/en-GB/manager/search/authentication/users

0 Karma
Highlighted

Re: How to list user accounts with domain?

Explorer

Thanks nickhillscpl,

but I dont know in the browser also listing only Splunk console users list.

All Active Directory user accounts count is 480,

listing only 13 user account, If i use " https://172.16.x.x:8000/en-GB/manager/search/authentication/users "

Is there any other method for listing All user accounts.

0 Karma
Highlighted

Re: How to list user accounts with domain?

Ultra Champion

So this sounds like the Search head you are running the query against only knows about the local users, which is why the management UI and the rest api is showing you a few of them.

Are you sure the missing users are LDAP, and not SAML?

0 Karma
Highlighted

Re: How to list user accounts with domain?

Explorer

Yes, missing users are LDAP.

Please confirm " http(s)://yoursplunksearch_head:8000" , is this splunk console IP? which i use to login splunk console?

0 Karma
Highlighted

Re: How to list user accounts with domain?

Ultra Champion

Yes, this should be the address of the splunk server you access the user interface through.

0 Karma
Highlighted

Re: How to list user accounts with domain?

Explorer

then i am using correct. why listing only few accounts and these user accounts are able to access splunk console, mean, listing accounts are able access "https://172.16.x.x:8000/en-US/account/login "

0 Karma
Highlighted

Re: How to list user accounts with domain?

Ultra Champion

Can you post the contents of $SPLUNK_HOME/etc/sytem/local/authentication.conf
(remove anything sensitive)

0 Karma