In reply to: john117 wrote a new post, Dashboard and App views by user This Splunk query / search shows historical access to dashboards and apps on a local splunk server. index=_internal sourcetype=splunk_web_access host=* […] View
This is GREAT!
Is there a way to map the user to their email or name? Would that require another join of some sort?
I looked into the base search and didn’t see an email or name field.
In reply to: ItsJohnLocke wrote a new post, Show all currently logged in users Use this Splunk rest query to list all currently logged in users (to your Splunk server). | rest /services/authentication/current-context | […] View
I am not sure what updated is supposed to do… but, it looked like something close to epoc time? Anyway, I cut it off and the query looked cleaner?
@gr33nlant3rn Active 3 years ago