Splunk Search

Top 10 Splunk Users

splunkcol
Builder

 

 

I need to get a top 10 of the users who use Splunk the most

Labels (1)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

hi @splunkcol,
The below query give top users who successfully logged into Splunk in the last 1 year.

index=_audit sourcetype=audittrail action="login attempt" info=succeeded earliest=-1y | top user

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Top 10 by what measure?  What problem are you trying to solve?

---
If this reply helps you, Karma would be appreciated.
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @splunkcol,
The below query give top users who successfully logged into Splunk in the last 1 year.

index=_audit sourcetype=audittrail action="login attempt" info=succeeded earliest=-1y | top user
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...