How do I get a complete list of users logging into Splunk Enterprise & ES

[SamHTexas]

How do I get a complete list of users logging into Splunk Enterprise & ES. Please share SPL strings used. How to prepare a list of users with multiple failed login attemps.

[gcusello]

Hi @SamHTexas,

for the Splunk Enteprise Users try this:

| rest /services/authentication/users splunk_server=local 
| fields title roles realname
| rename title AS userName realname AS Name

For the ES, see the dashboad described at https://community.splunk.com/t5/Getting-Data-In/Rest-API-get-users-assigned-to-a-role/td-p/379055

or simply try something like this:

| rest /services/authentication/users roles="ES"
| fields title
| rename title as "User/s (for selected Roles)"

I haven't in this moment an ES to find the exact string for ES_Roles, but you can find them using this search

| rest /services/authorization/roles/
| fields title

Ciao.

Giuseppe

[SamHTexas · Accepted solution]

Grazie, for these. The first one worked for both Ent. & ES very well. But the last two did not. But one more questions please. Is there way to get a list of brute force attempted logins to Ent. & ES ? Thank u

[gcusello]

Hi @SamHTexas,

this is another different question and it should be better to create a new question!

Anyway, you can create a search for the failed login to splunk (eventtype=Splunk_Audit info=failed) defining a theshold (e.g. 10 times in 1 minute:

eventtype=Splunk_Audit info=failed earliest=-60s latest=now
| stats count
| where count>10

Ciao.

Giuseppe