Splunk Search

Email report on Splunk Users

ma_anand1984
Contributor

I would like to create an email report with following details that runs every day

All admin users
All power users
User role - users count

Tags (4)
0 Karma
1 Solution

Ayn
Legend

There are no search commands that return this, so you'd have to write your own that gets that kind of info from the Splunk REST API endpoint and returns it.

View solution in original post

ma_anand1984
Contributor

seems we can use the brand new command | rest to access the information !!!

0 Karma

ma_anand1984
Contributor

@cboeing

try this

| rest splunk_server=local /servicesNS/-/-/authentication/users count=0 | table title email realname roles type

LiquidTension
Path Finder

This is great!!

cboeing
Engager

Hi Ma_anand1984,
would you share with what you ended up using?

Ayn
Legend

There are no search commands that return this, so you'd have to write your own that gets that kind of info from the Splunk REST API endpoint and returns it.

ma_anand1984
Contributor

any help please

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...