Splunk Search

Top 10 Splunk Users

splunkcol
Builder

 

 

I need to get a top 10 of the users who use Splunk the most

Labels (1)
0 Karma
1 Solution

manjunathmeti
Champion

hi @splunkcol,
The below query give top users who successfully logged into Splunk in the last 1 year.

index=_audit sourcetype=audittrail action="login attempt" info=succeeded earliest=-1y | top user

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Top 10 by what measure?  What problem are you trying to solve?

---
If this reply helps you, Karma would be appreciated.
0 Karma

manjunathmeti
Champion

hi @splunkcol,
The below query give top users who successfully logged into Splunk in the last 1 year.

index=_audit sourcetype=audittrail action="login attempt" info=succeeded earliest=-1y | top user
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...