Hi Splunk Community,
I'm trying to list all splunk local users (authentication system = splunk) . The below search lists all users SAML and Splunk but I'm only looking for local accounts.
| rest /services/authentication/users splunk_server=local
| fields roles title realname
| rename title as username
Thanks!
| rest /services/authentication/users splunk_server=local
| fields roles title type email
| rename title as username
| search type=SPLUNK
| rest /services/authentication/users splunk_server=local
| fields roles title type email
| rename title as username
| search type=SPLUNK