How can I search top 10 users of splunk ?

[splunker969]

How can I search top 10 users of splunk ? Any query Help ?? Iam not sure below query is correct ?

index=_audit action="success" info=succeeded | stats count by user | sort - count | head 10

[s2_splunk]

Is the top command what you are looking for?

[splunker969]

Users running more adhoc searches?

Users running more schedule searches?

Users logging in more times?

Users visiting more dashboards?
@ssievert

[493669]

Try Below query

| rest /services/authentication/httpauth-tokens splunk_server=local |stats count by userName |sort - count | head 10

It will work

[splunker969]

Thanks @493669 .Since i am looking for above @ @gpradeepkumararreddy mentioned .The query that you sent will help to check which splunk servers user are logging .Thanks for the query 🙂

[pradeepkumarg]

What do you mean by top 10 users? There are different dimension to this.

Probably you can combine all of the below to achieve what you are looking at

1. Users running more adhoc searches? - audit logs
2. Users running more schedule searches? - scheduler logs
3. Users logging in more times? - audit logs
4. Users visiting more dashboards? - web access logs

[splunker969]

Can you please help me with query @gpradeepkumararreddy

[splunker969]

@somesoni2 any help ?