Splunk Enterprise Security

List of users on Linux and Windows clients, how we can get it?

infosec_kicb
New Member

Hi guys,
Nothing comes to mind. How to get a list of users in operating systems using splunk forwarder?

0 Karma

saramamurthy_sp
Splunk Employee
Splunk Employee

Are you speaking about Linux or Splunk Users?

if Linux Users, you have to install on your forwarder a TA-Linux that contains a script to collect Linux users.

If you don't want to install the full TA_Linux, you can take only the script to extract users ($SPLUNK_HOME/etc/apps/Splunk_TA_nix/ bin/usersWithLoginPrivs.sh).

After you can search them in Splunk with a simple search ( index=os | dedup users | table users ).

Cheers.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...