Hi at all,
I'd like to identify Splunk currently and/or today's logged users.
Using | rest /services/authentication/current-context splunk_server=local | rename username AS user | table user realname roles I can identify the logged users; and using index=_audit NOT (user="n/a" OR user="splunk-system-user" OR "scheduler__nobody__search" OR "admin" OR "nobody") NOT "REST" NOT scheduler | join type=left user [| rest /services/authentication/current-context splunk_server=local | rename username AS user | table user realname roles ] | transaction user I can identify today's logged users.
My problem is to identify when users was logged in because I have Splunk configured in SSO with an external authentication system so I cannot find action="login attempt" (that I usually find in _audit index to understand that a user is logged in).
Someone has an idea how to have the time session of a Splunk user when there is a SSO authentication?
Bye.
Giuseppe
