Top 10 Splunk Users

[splunkcol]

I need to get a top 10 of the users who use Splunk the most

[richgalloway]

Top 10 by what measure?  What problem are you trying to solve?

[manjunathmeti · Accepted solution]

hi @splunkcol,
The below query give top users who successfully logged into Splunk in the last 1 year.

index=_audit sourcetype=audittrail action="login attempt" info=succeeded earliest=-1y | top user