topic Re: I need to know which index and app has been access how many time in last one month in Splunk Search

I need to know which index and app has been access how many time in last one month

csharm21 — Mon, 27 Jan 2020 12:19:17 GMT

I need to know how many time all the indexes in my splunk has been accessed in last 30 days by app name(I tried so many posts but none of the post resolved my issue). can anyone help me to get this fixed.

Re: I need to know which index and app has been access how many time in last one month

broberg — Mon, 27 Jan 2020 12:21:46 GMT

What you mean by "accessed", do you mean how many time somone searched in an index?
That information can you see in _audit.

Re: I need to know which index and app has been access how many time in last one month

csharm21 — Mon, 27 Jan 2020 12:24:57 GMT

@broberge yes i need to pull detail how many time some one searched the index. if that index has not been searched more then one month, we will do clean up. I tried multiple things using _Audit but still no luck.

Re: I need to know which index and app has been access how many time in last one month

p_gurav — Mon, 27 Jan 2020 12:50:41 GMT

This may help you:

index=_audit action=search search=* sourcetype=audittrail  | rex field=search "sourcetype\s*=\s*\"*(?<SourcetypeUsed>[^\s\"]+)"  | rex field=search "index\s*=\s*\"*(?<IndexUsed>[^\s\"]+)" | search IndexUsed=* OR SourcetypeUsed=* | fillnull value="NA" IndexUsed SourcetypeUsed| stats count by IndexUsed SourcetypeUsed

The count represents a number of searches execution that are using that index/sourcetype.

Re: I need to know which index and app has been access how many time in last one month

csharm21 — Mon, 27 Jan 2020 13:29:39 GMT

Thanks p_gurav, this is working. I also need to filter this by application name. would you be able to help on this.

Re: I need to know which index and app has been access how many time in last one month

efavreau — Mon, 27 Jan 2020 16:11:41 GMT

Based on the comment thread, @p_gurav, you should convert your comment to an answer, so @csharm21 can accept it.
@csharm21 you should ask that as a separate question, in my humble opinion. Adding the APP to the query, most likely means you're querying _internal also, which would require a lot more work to add in.