How can I search top 10 users of splunk ? Any query Help ?? Iam not sure below query is correct ?
index=_audit action="success" info=succeeded | stats count by user | sort - count | head 10
Is the top command what you are looking for?
Users running more adhoc searches?
Users running more schedule searches?
Users logging in more times?
Users visiting more dashboards?
@ssievert
Try Below query
| rest /services/authentication/httpauth-tokens splunk_server=local |stats count by userName |sort - count | head 10
It will work
Thanks @493669 .Since i am looking for above @ @gpradeepkumararreddy mentioned .The query that you sent will help to check which splunk servers user are logging .Thanks for the query 🙂
What do you mean by top 10 users? There are different dimension to this.
Probably you can combine all of the below to achieve what you are looking at
Can you please help me with query @gpradeepkumararreddy
@somesoni2 any help ?