https://community.splunk.com/t5/Getting-Data-In/How-to-audit-REST-api-initiated-searches/m-p/91322#M18982 <P>We have a case where they are not being logged so I'm going to track it down. Thanks for your response.</P> Wed, 10 Jul 2013 22:39:14 GMT the_wolverine 2013-07-10T22:39:14Z https://community.splunk.com/t5/Getting-Data-In/How-to-audit-REST-api-initiated-searches/m-p/91320#M18980 <P>I'm looking to audit REST API search activity and I'm unable to locate any logging of REST API initiated searches. I just need to know what queries are being run and by whom.</P> Wed, 10 Jul 2013 17:55:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-audit-REST-api-initiated-searches/m-p/91320#M18980 the_wolverine 2013-07-10T17:55:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-audit-REST-api-initiated-searches/m-p/91321#M18981 <P>Following query provides list of all the searches being executed by all the users (including scheduled searches and REST API searches</P> <P>index=_audit action="search" search="*"</P> <P>Further, you can differentiate Scheduled searches with adhoc searches using following:</P> <P>|eval adhoc=if(NOT user="splunk-system-user",1,0) | eval schd=if(user="splunk-system-user",1,0)</P> Wed, 10 Jul 2013 21:22:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-audit-REST-api-initiated-searches/m-p/91321#M18981 somesoni2 2013-07-10T21:22:23Z https://community.splunk.com/t5/Getting-Data-In/How-to-audit-REST-api-initiated-searches/m-p/91322#M18982 <P>We have a case where they are not being logged so I'm going to track it down. Thanks for your response.</P> Wed, 10 Jul 2013 22:39:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-audit-REST-api-initiated-searches/m-p/91322#M18982 the_wolverine 2013-07-10T22:39:14Z