I am trying to get the list of all user accounts using below code, but the result showing only Splunk console users list instead of all Active Directory User Account List.
| rest splunk_server=local /servicesNS/-/-/authentication/users count=0 | table title email real name type
like this result is showing only 10 lines, all these are splunk console users. I dont know why all Active Directory User Accounts not showing.
Could anyone help me & guide me on this.
Thanks in advance.
From that same searchhead, can you see the LDAP users if you go to
but I dont know in the browser also listing only Splunk console users list.
All Active Directory user accounts count is 480,
listing only 13 user account, If i use " https://172.16.x.x:8000/en-GB/manager/search/authentication/users "
Is there any other method for listing All user accounts.
So this sounds like the Search head you are running the query against only knows about the local users, which is why the management UI and the rest api is showing you a few of them.
Are you sure the missing users are LDAP, and not SAML?
Yes, missing users are LDAP.
Please confirm " http(s)://yoursplunksearch_head:8000" , is this splunk console IP? which i use to login splunk console?