i need a query for all active and inactive users which are in Splunk ES with out using "reset" key
Thanks for responding to my question.
Yes we need to check active and inactive users from splunk from last 30 days.
We tried wit reset key but it disn't work out.
So please send a query without rest key.,Hi,
Thanks for replaying to my question.
Yes we need to find users from splunk only.
We did not exceded license quota, but we donot to use it. We tried with that query but we didnot get the proper results.
More information is needed. Define "active" and "inactive". Users of what, Splunk or something else?
Why are you referencing a reset key? Have you exceeded your license quota?