Need SPLs to list the current users in Splunk Ent. and ES. Plus listing unauthorized accts created / deleted. Thank u

[SamHTexas]

Need SPLs to list the current users in Splunk Ent. and ES. Plus listing unauthorized accts created / deleted. Thank u very much in advance.

[SamHTexas]

Thank u sir as always.

[richgalloway · Accepted solution]

To get a list of Splunk users, start with this REST command

| rest /services/authentication/users

To find newly created or deleted accounts, try this search.  It's up to you to determine if they're authorized or not.  As far as Splunk is concerned, someone with the right capabilities created or deleted the account so it must be authorized.

index=_audit action IN (create_user remove_user)