disabled user list

[Mohsin123]

how to get list of disabled users in splunk ? any query ?

i was checking for orphaned object query :

| rest timeout=600 splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0
| search orphan=1

does it help ?

[mayurr98]

do you mean inactive users?

 | rest /services/authentication/users splunk_server=local 
 | fields realname, title
 | rename title as user
 | join user type=left [
    | search index=_audit action="login attempt" earliest=-12mon
    | stats max(timestamp) as _time by user, sourcetype
 ]
 | where isnull(sourcetype)
 | fields - sourcetype

Also, have a look at this answer
https://answers.splunk.com/answers/481/search-for-inactive-splunk-users.html

let me know if this helps!