What do you mean by top 10 users? There are different dimension to this.
Probably you can combine all of the below to achieve what you are looking at
Try Below query
| rest /services/authentication/httpauth-tokens splunk_server=local |stats count by userName |sort - count | head 10
It will work
Thanks @493669 .Since i am looking for above @ @gpradeepkumararreddy mentioned .The query that you sent will help to check which splunk servers user are logging .Thanks for the query 🙂
Users running more adhoc searches?
Users running more schedule searches?
Users logging in more times?
Users visiting more dashboards?