Monitoring Splunk

Need SPLs to list the current users in Splunk Ent. and ES. Plus listing unauthorized accts created / deleted. Thank u

SamHTexas
Builder

Need SPLs to list the current users in Splunk Ent. and ES. Plus listing unauthorized accts created / deleted. Thank u very much in advance.

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To get a list of Splunk users, start with this REST command

| rest /services/authentication/users

To find newly created or deleted accounts, try this search.  It's up to you to determine if they're authorized or not.  As far as Splunk is concerned, someone with the right capabilities created or deleted the account so it must be authorized.

index=_audit action IN (create_user remove_user)

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

SamHTexas
Builder

Thank u sir as always.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

To get a list of Splunk users, start with this REST command

| rest /services/authentication/users

To find newly created or deleted accounts, try this search.  It's up to you to determine if they're authorized or not.  As far as Splunk is concerned, someone with the right capabilities created or deleted the account so it must be authorized.

index=_audit action IN (create_user remove_user)

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...