Splunk Search

Email report on Splunk Users

ma_anand1984
Contributor

I would like to create an email report with following details that runs every day

All admin users
All power users
User role - users count

Tags (4)
0 Karma
1 Solution

Ayn
Legend

There are no search commands that return this, so you'd have to write your own that gets that kind of info from the Splunk REST API endpoint and returns it.

View solution in original post

ma_anand1984
Contributor

seems we can use the brand new command | rest to access the information !!!

0 Karma

ma_anand1984
Contributor

@cboeing

try this

| rest splunk_server=local /servicesNS/-/-/authentication/users count=0 | table title email realname roles type

LiquidTension
Path Finder

This is great!!

cboeing
Engager

Hi Ma_anand1984,
would you share with what you ended up using?

Ayn
Legend

There are no search commands that return this, so you'd have to write your own that gets that kind of info from the Splunk REST API endpoint and returns it.

ma_anand1984
Contributor

any help please

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...