Splunk Search

Can someone tell me how to count users by index please

New Member

I was trying to keep track of how many users have access to each index. Any help would be much appreciated.

Tags (2)
0 Karma


This should do the trick:

| rest /services/authentication/users | table title roles | mvexpand roles | join max=0 type=left roles [rest /services/authorization/roles | table title srchIndexesAllowed | rename title as roles | mvexpand srchIndexesAllowed] | stats dc(title) by srchIndexesAllowed

You'll see values for srchIndexesAllowed of "*" and "_*", those mean "all non-internal indexes" and "all internal indexes" respectively.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.