how to get list of disabled users in splunk ? any query ?
i was checking for orphaned object query :
| rest timeout=600 splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0
| search orphan=1
does it help ?
do you mean inactive users?
| rest /services/authentication/users splunk_server=local
| fields realname, title
| rename title as user
| join user type=left [
| search index=_audit action="login attempt" earliest=-12mon
| stats max(timestamp) as _time by user, sourcetype
]
| where isnull(sourcetype)
| fields - sourcetype
Also, have a look at this answer
https://answers.splunk.com/answers/481/search-for-inactive-splunk-users.html
let me know if this helps!