SPL
Show all currently logged in users
Description
Use this Splunk rest query to list all currently logged in users (to your Splunk server).
| rest /services/authentication/current-context | search NOT username="splunk-system-user" | table username roles updated
3 0
Comments
1 total
I am not sure what updated is supposed to do... but, it looked like something close to epoc time? Anyway, I cut it off and the query looked cleaner?
Leave a comment
You must log in to post a comment.