SPL
REST API: Table all Splunk User Email Addresses
Description
The following simple Splunk query will put all Splunk User accounts with an email address into a panel for copy and paste purposes (such as copying all email addresses to send in an email). I've added a semi colon delimiter in order to literally be copy and paste into an application such as Microsoft Outlook.
3 0
| rest /services/authentication/users | search email!="" | dedup email| stats count by email | mvcombine delim=";" email | nomv email | fields - count | rename email as "Email Addresses"
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.