Splunk Search

How can I search top 10 users of splunk ?

splunker969
Communicator

How can I search top 10 users of splunk ? Any query Help ?? Iam not sure below query is correct ?

index=_audit action="success" info=succeeded | stats count by user | sort - count | head 10

Tags (2)
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Is the top command what you are looking for?

0 Karma

splunker969
Communicator

Users running more adhoc searches?

Users running more schedule searches?

Users logging in more times?

Users visiting more dashboards?
@ssievert

0 Karma

493669
Super Champion

Try Below query

| rest /services/authentication/httpauth-tokens splunk_server=local |stats count by userName |sort - count | head 10

It will work

0 Karma

splunker969
Communicator

Thanks @493669 .Since i am looking for above @ @gpradeepkumararreddy mentioned .The query that you sent will help to check which splunk servers user are logging .Thanks for the query 🙂

0 Karma

pradeepkumarg
Influencer

What do you mean by top 10 users? There are different dimension to this.

Probably you can combine all of the below to achieve what you are looking at

  1. Users running more adhoc searches? - audit logs
  2. Users running more schedule searches? - scheduler logs
  3. Users logging in more times? - audit logs
  4. Users visiting more dashboards? - web access logs
0 Karma

splunker969
Communicator

Can you please help me with query @gpradeepkumararreddy

0 Karma

splunker969
Communicator

@somesoni2 any help ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...