Can someone tell me how to count users by index please

[Rlemana]

I was trying to keep track of how many users have access to each index. Any help would be much appreciated.

[martin_mueller]

This should do the trick:

| rest /services/authentication/users | table title roles | mvexpand roles | join max=0 type=left roles [rest /services/authorization/roles | table title srchIndexesAllowed | rename title as roles | mvexpand srchIndexesAllowed] | stats dc(title) by srchIndexesAllowed

You'll see values for srchIndexesAllowed of "*" and "_*", those mean "all non-internal indexes" and "all internal indexes" respectively.