Splunk Search

Can someone tell me how to count users by index please

New Member

I was trying to keep track of how many users have access to each index. Any help would be much appreciated.

Tags (2)
0 Karma


This should do the trick:

| rest /services/authentication/users | table title roles | mvexpand roles | join max=0 type=left roles [rest /services/authorization/roles | table title srchIndexesAllowed | rename title as roles | mvexpand srchIndexesAllowed] | stats dc(title) by srchIndexesAllowed

You'll see values for srchIndexesAllowed of "*" and "_*", those mean "all non-internal indexes" and "all internal indexes" respectively.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!