https://community.splunk.com/t5/Monitoring-Splunk/Can-somebody-from-Splunk-please-explain-the-changes-to-GUI/m-p/67799#M771 <P>Prior to the 5.x (and possibly earlier), Splunk logged user searches from the GUI in a human readable format. The event had the user name and something like search="search bla bla bla | stats count by bla...". It was easy to read and audit.</P> <P>Now when I look in the _internal index for searches that I or other users have run, all the searches are URL encoded. They are way more difficult to read and audit. </P> <P>Why would you guys elect to make those logging events less human readable and what is the best method to advocate for changing the logging format back to something I can read?</P> <P>Thx.</P> <P>C</P> Tue, 18 Jun 2013 21:16:46 GMT responsys_cm 2013-06-18T21:16:46Z https://community.splunk.com/t5/Monitoring-Splunk/Can-somebody-from-Splunk-please-explain-the-changes-to-GUI/m-p/67799#M771 <P>Prior to the 5.x (and possibly earlier), Splunk logged user searches from the GUI in a human readable format. The event had the user name and something like search="search bla bla bla | stats count by bla...". It was easy to read and audit.</P> <P>Now when I look in the _internal index for searches that I or other users have run, all the searches are URL encoded. They are way more difficult to read and audit. </P> <P>Why would you guys elect to make those logging events less human readable and what is the best method to advocate for changing the logging format back to something I can read?</P> <P>Thx.</P> <P>C</P> Tue, 18 Jun 2013 21:16:46 GMT https://community.splunk.com/t5/Monitoring-Splunk/Can-somebody-from-Splunk-please-explain-the-changes-to-GUI/m-p/67799#M771 responsys_cm 2013-06-18T21:16:46Z https://community.splunk.com/t5/Monitoring-Splunk/Can-somebody-from-Splunk-please-explain-the-changes-to-GUI/m-p/67800#M772 <P>I'm pretty sure you are referencing <CODE>$SPLUNK_HOME/var/log/splunk/searches.log</CODE>, which was indeed retired in 5.0 because the same level of information (and then some) is available from audit.log and in the _audit index.</P> <P>The good news is it's pretty easy to gain access to the same level of information by searching the _audit index:</P> <PRE><CODE>index=_audit search=* </CODE></PRE> <P>If you want to make it fancier and show more information such as the start and end time range of the search, you can use this search:</P> <PRE><CODE>index=_audit search=* | eval earliest_time=if(like(apiStartTime,"%ZERO_TIME%"),"epoch",apiStartTime) | eval latest_time=if(like(apiEndTime,"%ZERO_TIME%"),"now",apiEndTime) | table _time user earliest_time latest_time search search_id </CODE></PRE> Wed, 26 Jun 2013 18:23:20 GMT https://community.splunk.com/t5/Monitoring-Splunk/Can-somebody-from-Splunk-please-explain-the-changes-to-GUI/m-p/67800#M772 hexx 2013-06-26T18:23:20Z