Splunk Enterprise Security

How to find out active and inactive users from last 30 days in splunk ES without using "reset"

Narendra02
New Member

i need a query for all active and inactive users which are in Splunk ES with out using "reset" key

0 Karma

Narendra02
New Member

Hi,
Thanks for responding to my question.
Yes we need to check active and inactive users from splunk from last 30 days.
We tried wit reset key but it disn't work out.
So please send a query without rest key.,Hi,
Thanks for replaying to my question.
Yes we need to find users from splunk only.
We did not exceded license quota, but we donot to use it. We tried with that query but we didnot get the proper results.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the queries you've tried already.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

More information is needed. Define "active" and "inactive". Users of what, Splunk or something else?
Why are you referencing a reset key? Have you exceeded your license quota?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...