Splunk search for Users by role and default app
Copy
| rest /services/authentication/users
| stats values(roles) as Role first(defaultApp) as "Default App" by title | rename title as Username
This search will provide a list of all users along with the role(s) they are associated with and their current default app
