topic Re: Query To Identify Who Has Exported Data in Reporting

Query To Identify Who Has Exported Data

IRHM73 — Wed, 22 Mar 2017 07:44:24 GMT

Hi, I wonder whether someone may be able to help me please.

I've tried for a few days to find a solution online bus so far I've been unsuccessful, but could someone tell me please, is there a query which I could to see who has exported Splunk data?

Many thanks and kind regards

Chris

Re: Query To Identify Who Has Exported Data

andrey2007 — Tue, 29 Sep 2020 13:22:25 GMT

May be this query will help you

index=_internal file=export | table file user uri_path

Re: Query To Identify Who Has Exported Data

rewritex — Wed, 22 Mar 2017 15:05:00 GMT

I exported a .csv using a specific name and searched for the name. I found the results using index=_internal filename=* . I'm on Splunk 6.5.2

Re: Query To Identify Who Has Exported Data

IRHM73 — Thu, 23 Mar 2017 08:54:06 GMT

Hi @rewritex, thank you for taking the time to come back to me with this. The solution from @audrey2007 was slightly more what I was looking for.

Many thanks and kind regards

Chris

Re: Query To Identify Who Has Exported Data

IRHM73 — Thu, 23 Mar 2017 08:59:58 GMT

Hi @audrey2007, thank you for taking the time to come back to me with this. It works perfectly.

Regards

Chris