Hi guys,
Nothing comes to mind. How to get a list of users in operating systems using splunk forwarder?
Are you speaking about Linux or Splunk Users?
if Linux Users, you have to install on your forwarder a TA-Linux that contains a script to collect Linux users.
If you don't want to install the full TA_Linux, you can take only the script to extract users ($SPLUNK_HOME/etc/apps/Splunk_TA_nix/ bin/usersWithLoginPrivs.sh).
After you can search them in Splunk with a simple search ( index=os | dedup users | table users ).
Cheers.