Splunk Search

Email report on Splunk Users

ma_anand1984
Contributor

I would like to create an email report with following details that runs every day

All admin users
All power users
User role - users count

Tags (4)
0 Karma
1 Solution

Ayn
Legend

There are no search commands that return this, so you'd have to write your own that gets that kind of info from the Splunk REST API endpoint and returns it.

View solution in original post

ma_anand1984
Contributor

seems we can use the brand new command | rest to access the information !!!

0 Karma

ma_anand1984
Contributor

@cboeing

try this

| rest splunk_server=local /servicesNS/-/-/authentication/users count=0 | table title email realname roles type

LiquidTension
Path Finder

This is great!!

cboeing
Engager

Hi Ma_anand1984,
would you share with what you ended up using?

Ayn
Legend

There are no search commands that return this, so you'd have to write your own that gets that kind of info from the Splunk REST API endpoint and returns it.

ma_anand1984
Contributor

any help please

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...