List of users on Linux and Windows clients, how we can get it?

[infosec_kicb]

Hi guys,
Nothing comes to mind. How to get a list of users in operating systems using splunk forwarder?

[saramamurthy_sp]

Are you speaking about Linux or Splunk Users?

if Linux Users, you have to install on your forwarder a TA-Linux that contains a script to collect Linux users.

If you don't want to install the full TA_Linux, you can take only the script to extract users ($SPLUNK_HOME/etc/apps/Splunk_TA_nix/ bin/usersWithLoginPrivs.sh).

After you can search them in Splunk with a simple search ( index=os | dedup users | table users ).

Cheers.