How-To: Export a List of Users

Last Updated: 2021-09-05

You can access a list of users through the UI, but if you want a text list of users, or a list to be used for auditing or verification purposes you need to export the list of users from your Humio instance. There are a few different options available.

Using GraphQL

If you want to export a list of users and any associated data, you can use a GraphQL query through the GraphiQL interface or through the command line. To do this, you need to construct a query that accesses the user object and the fields from the user object you need.

There are additional fields that you might want to include within your search, for example to extract the email of the user, or determine whether they are the owner of an organization (the organization root). You can do this be expanding the list of fields in the query:

Note

Organisation owners cannot list users. For an alternative, see Using usersPage

{
 users {
 firstName
 lastName
 username
 }
}

The query returns the requested fields as a nested list of JSON objects:

json
{
 "data": {
 "users": [
 {
 "firstName": "Martin",
 "lastName": "Smith",
 "username": "developer"
 },
 {
 "firstName": "Dave",
 "lastName": "Johnson",
 "username": "dave"
 },
 {
 "firstName": "Phil",
 "lastName": "Brown",
 "username": "phil"
 },
 {
 "firstName": "John",
 "lastName": "Smith",
 "username": "john"
 }
 ]
 }
}

From the command-line using curl:

curl -v -XPOST -H "Content-Type: application/json" \
 http://humio.example.com/graphql \
 -d '{ "query": "{ accounts { username } }" }'

Alternatively, to determine the group they are a member of you add the groups field and include the displayName to get the name of each group:

{
 users {
 id
 isRoot
 isOrgRoot
 createdAt
 email
 groups {
 id
 displayName 
 }
 }
}

Note that the groups block is output only users that have been made part of a group.

json
{
 "data": {
 "users": [
 {
 "isRoot": true,
 "email": null,
 "isOrgRoot": true,
 "groups": [
 {
 "id": "IIp50mVkLZknQ6qthB5mdwiMJmwME0br",
 "displayName": "humio.members"
 }
 ],
 "createdAt": "2021-09-01T16:45:05.696Z",
 "id": "445nrP4AVFvWYq5EYvaNOi2Y"
 },
 {
 "isRoot": false,
 "email": null,
 "isOrgRoot": false,
 "groups": [],
 "createdAt": "2021-09-05T09:26:18.349Z",
 "id": "6KEeKjJBDxM8Ty2ztTEOEwRM"
 },
 {
 "isRoot": false,
 "email": null,
 "isOrgRoot": false,
 "groups": [],
 "createdAt": "2021-09-05T09:25:57.151Z",
 "id": "J1BaNC1EvaHvGTU4FG8bzPxv"
 },
 {
 "isRoot": false,
 "email": null,
 "isOrgRoot": false,
 "groups": [],
 "createdAt": "2021-09-05T09:25:51.328Z",
 "id": "vxtgZC5EsDeSceAUFNaCCcEr"
 }
 ]
 }
}

Using usersPage

To access a list of users as an organisation owner when you are not an organisation owner you can use the usersPage. The pageSize defines the number of users to return in a single page; the pageNumber is the page to be displayed. Page 1 shows the first 2000, page 2 shows 2001-4000 and so on:

default
query {
 usersPage(pageSize: 2000, pageNumber: 1) {
 page {
 username
 displayName
 email
 }
 }
}

Using humioctl

You can also obtain a list of users using the humioctl command-line interface:

./bin/humioctl users list

Username Name Root Created
developer yes 2021-09-01T16:45:05.696Z 445nrP4AVFvWYq5EYvaNOi2Y
dave no 2021-09-05T09:26:18.349Z 6KEeKjJBDxM8Ty2ztTEOEwRM
phil no 2021-09-05T09:25:57.151Z J1BaNC1EvaHvGTU4FG8bzPxv
john no 2021-09-05T09:25:51.328Z vxtgZC5EsDeSceAUFNaCCcEr

For more information, see humioctl.

Querying Humio Repo

Another way to get a list of user activity within Humio is to query the humio repository and look for log entries containing the string c.h.u.Users$ string. This shows all activity involving this class within Humio. For example:

default
2021-09-05T10:25:51.333+0100 [humio-gql-mutations-434] INFO c.h.u.Users$ 1 - creating user id=vxtgZC5EsDeSceAUFNaCCcEr, email=john, isroot=false
2021-09-05T10:25:57.153+0100 [humio-gql-mutations-436] INFO c.h.u.Users$ 1 - creating user id=J1BaNC1EvaHvGTU4FG8bzPxv, email=phil, isroot=false
2021-09-05T10:26:01.455+0100 [humio-gql-mutations-437] INFO c.h.u.Users$ 1 - creating user id=zbG8kWWUnctRWytiGL9nMc6e, email=dav, isroot=false

Because you are accessing a list of the activities that create the user, rather than the current user list, this method can be used to determine the historic user configuration.