Hi All ,
The requirement is to get all usernames , username created date and email associated to it as below
username username_created_date email_associated
testnoob 03/22/2022 email@example.com
how can i achieve this ? can you please help me
Start with this REST command then add to the SPL as necessary to get the desired results.
| rest /servicesNS/-/-/admin/users
I'm pretty sure Splunk does not store the creation time of an account other than what's in the audit index. Don't trust the updated time, either, as I've seen it be wrong (zero) almost all the time.
index=_audit action=edit_user operation=create
|rename object as user
|eval timestamp=strptime(timestamp, "%m-%d-%Y %H:%M:%S.%3N")
|convert timeformat="%d/%b/%Y" ctime(timestamp)
|table user timestamp
If i use above query i get only part of the users ( 17 users ) with username and account created date , but not whole list of users ( 400 users) with username and account created date.
Is there any restriction in splunk , why is it only pulling part of the users list and not complete ?
That query will only show recently-created accounts - those created during the retention period of the audit index.
To keep those events longer, consider writing them to a summary index with a longer retention period.