Splunk Search

Splunk Search to list local User accounts

iamsplunker
Communicator

Hi Splunk Community, 

I'm trying to list all splunk local users (authentication system = splunk) . The below search lists all users SAML and Splunk but I'm only looking for local accounts.

| rest /services/authentication/users splunk_server=local
| fields roles title realname
| rename title as username

Thanks!

0 Karma
1 Solution

iamsplunker
Communicator

| rest /services/authentication/users splunk_server=local
| fields roles title type email
| rename title as username
| search type=SPLUNK

View solution in original post

0 Karma

iamsplunker
Communicator

| rest /services/authentication/users splunk_server=local
| fields roles title type email
| rename title as username
| search type=SPLUNK

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...