Email report on Splunk Users

[ma_anand1984]

I would like to create an email report with following details that runs every day

All admin users
All power users
User role - users count

[ma_anand1984]

seems we can use the brand new command | rest to access the information !!!

[ma_anand1984]

@cboeing

try this

| rest splunk_server=local /servicesNS/-/-/authentication/users count=0 | table title email realname roles type

[LiquidTension]

This is great!!

[cboeing]

Hi Ma_anand1984,
would you share with what you ended up using?

[Ayn · Accepted solution]

There are no search commands that return this, so you'd have to write your own that gets that kind of info from the Splunk REST API endpoint and returns it.

[ma_anand1984]

any help please