Splunk Enterprise

How do I get a list of all the users, admin or not in Splunk Enterprise or ES & date they were added? Thank u very much

SamHTexas
Builder

I need to get a complete list of all users in Splunk Enterprise or Ent. Security & the date the user account was added. Thank u in advance.

Labels (1)
Tags (1)
0 Karma

codebuilder
SplunkTrust
SplunkTrust

You can run this to get the info you're looking for:

|rest /services/authentication/users splunk_server=local

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

SamHTexas
Builder

Thx bro for this. Which server is best to run this on? I ran it on a Search head & the Deployment server & it only gives you info about the admin account & what this acct is running with the "system". Am looking to find list of new users added & when? Please advise.

Tags (1)
0 Karma

codebuilder
SplunkTrust
SplunkTrust

You'll want to run it on the search head as admin.

You can also show particular fields you want as below. Modify as needed.

|rest /services/authentication/users splunk_server=local
|fields title roles realname|rename title as userName, realname as Name

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...