Splunk Enterprise Security

How to find out active and inactive users from last 30 days in splunk ES without using "reset"

Narendra02
New Member

i need a query for all active and inactive users which are in Splunk ES with out using "reset" key

0 Karma

Narendra02
New Member

Hi,
Thanks for responding to my question.
Yes we need to check active and inactive users from splunk from last 30 days.
We tried wit reset key but it disn't work out.
So please send a query without rest key.,Hi,
Thanks for replaying to my question.
Yes we need to find users from splunk only.
We did not exceded license quota, but we donot to use it. We tried with that query but we didnot get the proper results.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the queries you've tried already.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

More information is needed. Define "active" and "inactive". Users of what, Splunk or something else?
Why are you referencing a reset key? Have you exceeded your license quota?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

  March 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

New This Month - Splunk Observability updates and improvements for faster ...

What’s New? This month, we’re delivering several enhancements across Splunk Observability Cloud for faster and ...

What's New in Splunk Cloud Platform 9.3.2411?

Hey Splunky People! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2411. This release ...