Splunk Search

Email report on Splunk Users

ma_anand1984
Contributor

I would like to create an email report with following details that runs every day

All admin users
All power users
User role - users count

Tags (4)
0 Karma
1 Solution

Ayn
Legend

There are no search commands that return this, so you'd have to write your own that gets that kind of info from the Splunk REST API endpoint and returns it.

View solution in original post

ma_anand1984
Contributor

seems we can use the brand new command | rest to access the information !!!

0 Karma

ma_anand1984
Contributor

@cboeing

try this

| rest splunk_server=local /servicesNS/-/-/authentication/users count=0 | table title email realname roles type

LiquidTension
Path Finder

This is great!!

cboeing
Engager

Hi Ma_anand1984,
would you share with what you ended up using?

Ayn
Legend

There are no search commands that return this, so you'd have to write your own that gets that kind of info from the Splunk REST API endpoint and returns it.

ma_anand1984
Contributor

any help please

0 Karma
Get Updates on the Splunk Community!

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...