Thanks @MuS  That works.  But I have another related questions. The result set of userName i get has some users which are no longer with the organization. So just clarifying if this rest call suggested above by anyways is related to saved searches too? Because we do have saved searches owned by users who have left the organization.  As of now, i don't think the report generated has correct data of currently logged in users. ... View more

@MuS -- If we are accessing a SH cluster via a LB and we issue the rest command using  splunk_server=local it will get the list from the connected SH only. Is there any way to get logged in users from all nodes of a SH cluster? In my setup i have 3 node SH cluster and the LB process requests based on least connections. ... View more