topic Re: How often users are searching for old data in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-often-users-are-searching-for-old-data/m-p/270019#M190034 <P>Interesting discussion about this at - <A href="https://answers.splunk.com/answers/92775/what-is-apistarttime-zero-time.html">what is apiStartTime='ZERO_TIME'</A></P> Sun, 24 Jul 2016 22:22:01 GMT ddrillic 2016-07-24T22:22:01Z How often users are searching for old data https://community.splunk.com/t5/Splunk-Search/How-often-users-are-searching-for-old-data/m-p/270017#M190032 <P>Is it possible to find out what time range Splunk users are searching for? We're upgrading our multi-site cluster from 6.3.3 to 6.4.2 to take advantage of tsidx reduction feature.<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.4.2/Indexer/Reducetsidxdiskusage">http://docs.splunk.com/Documentation/Splunk/6.4.2/Indexer/Reducetsidxdiskusage</A><BR /> I need to figure out what time range users are searching for? In particular how often searches are run against data that's more than 30/60 days old in 24 hours period? How can I find out this information? What search do I need to run on CM/SHs?</P> Sun, 24 Jul 2016 19:51:47 GMT https://community.splunk.com/t5/Splunk-Search/How-often-users-are-searching-for-old-data/m-p/270017#M190032 shahzadarif 2016-07-24T19:51:47Z Re: How often users are searching for old data https://community.splunk.com/t5/Splunk-Search/How-often-users-are-searching-for-old-data/m-p/270018#M190033 <P><CODE>index=_audit action=search info=granted search=*</CODE> has the time range used in <CODE>apiStartTime</CODE> and <CODE>apiEndTime</CODE>.</P> Sun, 24 Jul 2016 21:53:22 GMT https://community.splunk.com/t5/Splunk-Search/How-often-users-are-searching-for-old-data/m-p/270018#M190033 martin_mueller 2016-07-24T21:53:22Z Re: How often users are searching for old data https://community.splunk.com/t5/Splunk-Search/How-often-users-are-searching-for-old-data/m-p/270019#M190034 <P>Interesting discussion about this at - <A href="https://answers.splunk.com/answers/92775/what-is-apistarttime-zero-time.html">what is apiStartTime='ZERO_TIME'</A></P> Sun, 24 Jul 2016 22:22:01 GMT https://community.splunk.com/t5/Splunk-Search/How-often-users-are-searching-for-old-data/m-p/270019#M190034 ddrillic 2016-07-24T22:22:01Z