Splunk Search
Highlighted

How can I search top 10 users of splunk ?

Communicator

How can I search top 10 users of splunk ? Any query Help ?? Iam not sure below query is correct ?

index=_audit action="success" info=succeeded | stats count by user | sort - count | head 10

Tags (2)
0 Karma
Highlighted

Re: How can I search top 10 users of splunk ?

Influencer

What do you mean by top 10 users? There are different dimension to this.

Probably you can combine all of the below to achieve what you are looking at

  1. Users running more adhoc searches? - audit logs
  2. Users running more schedule searches? - scheduler logs
  3. Users logging in more times? - audit logs
  4. Users visiting more dashboards? - web access logs
0 Karma
Highlighted

Re: How can I search top 10 users of splunk ?

Communicator

Can you please help me with query @gpradeepkumararreddy

0 Karma
Highlighted

Re: How can I search top 10 users of splunk ?

Communicator

@somesoni2 any help ?

0 Karma
Highlighted

Re: How can I search top 10 users of splunk ?

Super Champion

Try Below query

| rest /services/authentication/httpauth-tokens splunk_server=local |stats count by userName |sort - count | head 10

It will work

0 Karma
Highlighted

Re: How can I search top 10 users of splunk ?

Communicator

Thanks @493669 .Since i am looking for above @ @gpradeepkumararreddy mentioned .The query that you sent will help to check which splunk servers user are logging .Thanks for the query 🙂

0 Karma
Highlighted

Re: How can I search top 10 users of splunk ?

Splunk Employee
Splunk Employee

Is the top command what you are looking for?

0 Karma
Highlighted

Re: How can I search top 10 users of splunk ?

Communicator

Users running more adhoc searches?

Users running more schedule searches?

Users logging in more times?

Users visiting more dashboards?
@ssievert

0 Karma