https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259095#M1900 <P>i want to see an event in incident review on admin activity, how to create a correlation search for, give me advice guys this is high priority. </P> Tue, 24 Jan 2017 22:18:35 GMT Rocky31 2017-01-24T22:18:35Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259095#M1900 <P>i want to see an event in incident review on admin activity, how to create a correlation search for, give me advice guys this is high priority. </P> Tue, 24 Jan 2017 22:18:35 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259095#M1900 Rocky31 2017-01-24T22:18:35Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259096#M1901 <P>You can create correlation search as per your requirement, however there aren't any data models which you can use for this. For admin activities you should be able to get data from _internal index.</P> Wed, 25 Jan 2017 09:33:42 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259096#M1901 hardikJsheth 2017-01-25T09:33:42Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259097#M1902 <P>Thanks for your reply. i don't see any internal index, you mean internal_audit_logs, splunk_audit. </P> <P>Thanks,</P> Tue, 29 Sep 2020 12:35:48 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259097#M1902 Rocky31 2020-09-29T12:35:48Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259098#M1903 <P>i mean what is best suitable application context.</P> Wed, 25 Jan 2017 14:41:39 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259098#M1903 Rocky31 2017-01-25T14:41:39Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259099#M1904 <P>I meant _internal. You can search through this index </P> <P>index=_internal </P> Fri, 27 Jan 2017 05:26:40 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259099#M1904 hardikJsheth 2017-01-27T05:26:40Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259100#M1905 <P>do i need admin access, to access this index.</P> Fri, 27 Jan 2017 14:20:54 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259100#M1905 Rocky31 2017-01-27T14:20:54Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259101#M1906 <P>The _ indexes (_internal, _audit) are often not available to standard users...also they are not searched by default so try the index=_internal and see if anything appears, if not run a query to check what index access you have...</P> Tue, 29 Sep 2020 12:34:23 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259101#M1906 gjanders 2020-09-29T12:34:23Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259102#M1907 <P>index=_internal (action=<EM>edit</EM>) user=admin<BR /> | table _time,user,user_email,action,info</P> <P>this is the search string i using, i checked in the roles access, i don't have access for _internal.</P> Tue, 29 Sep 2020 12:40:16 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259102#M1907 Rocky31 2020-09-29T12:40:16Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259103#M1908 <P>I use <BR /> | eventcount summarize=f index=_* index=* | dedup index | table index</P> <P>FYI, but if you don't have _internal access you won't see the various sources you need...</P> Tue, 31 Jan 2017 00:38:27 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259103#M1908 gjanders 2017-01-31T00:38:27Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259104#M1909 <P>You may want to look at some of the audit dashboards in ES and consider using them as a starting point for the correlation search you want to write. For example, the Search Audit dashboard has a panel that calculates run time, but it contains the search itself as well as the user and time. Drilling into it you can see that is uses the macro search_activity and then works on that to format the output and calculate time. You could potentially use that as a starting point and tweak to look at activity that a specific account name, like admin is doing. Correlation searches do not need to use data models though it makes a lot of sense to in most cases when dealing with sensors and endpoints that can be heterogenous.</P> Thu, 02 Feb 2017 00:23:04 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-it-possible-to-create-a/m-p/259104#M1909 jstoner_splunk 2017-02-02T00:23:04Z