topic Re: User Activity Report? It is not Splunk console user activity report. in Reporting

User Activity Report? It is not Splunk console user activity report.

brpsingara — Tue, 29 Sep 2020 23:41:03 GMT

I created a report as like below for every 4 hours. But the problem is, Splunk does not sending the scheduled reports to email due the report size. when I download manually from "Searches, reports, and alerts", size of the csv report is approx 300MB. Is possible to schedule zip report ?

Account_Name=goc_*

This means i want user activity report for who started with the user account "goc_*

Re: User Activity Report? It is not Splunk console user activity report.

nickhills — Tue, 12 Mar 2019 14:35:09 GMT

No, Out of the box Splunk can not send zipped emails.
You would need to build a custom alert to do this, or simply reduce the size(bytes) of the report it generates.
Either include fewer fields (using table), or fewer results (by scheduling more frequently)

However a 300MB report is HUGE, what on earth does it contain!?

Re: User Activity Report? It is not Splunk console user activity report.

brpsingara — Tue, 12 Mar 2019 16:40:44 GMT

I want to reduce the size of report and the report should be fewer fields (what user did on the data centre machines - Time, user name, Source IP/Host, destination IP/Host/Application, action Success/failure, what type of event is this - add, change, delete,execute ).

Could you please provide the code for "User Activity Report by using Splunk ".

Thanks in advance.

Re: User Activity Report? It is not Splunk console user activity report.

nickhills — Tue, 12 Mar 2019 16:44:34 GMT

Can you provide a sample of the data the report contains, just a few rows, not the full 300 mb 🙂

Remember to remove anything sensitive.

Re: User Activity Report? It is not Splunk console user activity report.

brpsingara — Tue, 29 Sep 2020 23:41:14 GMT

Hi Nick,

Here the example of scheduled report by me.

Account_Name=goc_* process_name!="c:\windows\explorer.exe"

Could you please help me to get this report simple, understandable and less size report.

Thanks in advance.

Re: User Activity Report? It is not Splunk console user activity report.

brpsingara — Tue, 12 Mar 2019 17:43:50 GMT

And I noticed there are many duplicate logs showing. same time stamp, same log showing in multiple times. How to avoid this?