topic Splunk Report Audit Report in Reporting

Splunk Report Audit Report

dejul — Thu, 28 Jul 2011 10:23:01 GMT

Hi all, is it possible to have a report run in Splunk which reports on which reports have been run in Splunk and who ran the report.

woodcock — Thu, 04 Jun 2015 21:42:44 GMT

In older versions of Splunk, you do it like this:

index=_internal sourcetype=searches |stats values(_raw) BY username

But starting in v5, you use the history command:

David — Thu, 04 Jun 2015 21:44:43 GMT

You can also audit searches in general and understand what users are doing with focused apps, such as one I built: Search Activity