How do you find out who is logged onto Splunk right now?

You can also get some information by searching some internal splunk logs:

1. Based on web access to splunkd web (ip address only)

   index=_internal source="*web_access.log" earliest=-15m | top clientip

2. User based on interactive searches:

   index=_internal source=searches | top user

3. User logins based on audit logs:

   index=_audit action="login attempt" "info=succeeded"

There doesn't seem to be any audit of any logout events, unfortunately.

You can find logout message in web_service.log

2010-06-27 04:21:40,855 INFO [4d416354d820e7f350] account:237 - user=matt action=logout status=success reason=user-initiated useragent="Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5" clientip=101.33.11.153

Under the 'status' dropdown in the Search app (if you are using 4.1+), you can slide out the 'Search Activity' submenu, and select "UI Activity". This shows you people who are accessing splunk via the web interface.

It doesn't really show you if they are actually doing something at that very moment, but you can narrow your list of people whom you need to call before doing maintenance...