https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-write-a-Splunk-audit-search/m-p/633094#M11338 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/254197">@sulaimancds</a>&nbsp;.. the _audit index will have all splunk user's search commands (search history).</P><P>&nbsp;</P><P>please check this:</P><P><A href="https://community.splunk.com/t5/Splunk-Search/Get-user-s-search-history/m-p/57744" target="_blank">https://community.splunk.com/t5/Splunk-Search/Get-user-s-search-history/m-p/57744</A></P> Fri, 03 Mar 2023 04:26:35 GMT inventsekar 2023-03-03T04:26:35Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-write-a-Splunk-audit-search/m-p/633090#M11337 <P>hi,</P> <P>&nbsp;</P> <P>i need to create a query or where can i find this information.</P> <P>&nbsp;</P> <P>i want the list of users who has run queries , for auditing purpose ,with the keyword PII on those queries which was run.</P> <P>&nbsp;</P> <P>Please help.</P> <P>&nbsp;</P> <P>&nbsp;</P> Fri, 03 Mar 2023 18:07:49 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-write-a-Splunk-audit-search/m-p/633090#M11337 sulaimancds 2023-03-03T18:07:49Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-write-a-Splunk-audit-search/m-p/633094#M11338 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/254197">@sulaimancds</a>&nbsp;.. the _audit index will have all splunk user's search commands (search history).</P><P>&nbsp;</P><P>please check this:</P><P><A href="https://community.splunk.com/t5/Splunk-Search/Get-user-s-search-history/m-p/57744" target="_blank">https://community.splunk.com/t5/Splunk-Search/Get-user-s-search-history/m-p/57744</A></P> Fri, 03 Mar 2023 04:26:35 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-write-a-Splunk-audit-search/m-p/633094#M11338 inventsekar 2023-03-03T04:26:35Z