topic Re: List of users who searched data of an index in Splunk Search

List of users who searched data of an index

svelagala — Sat, 16 May 2020 19:42:54 GMT

How to get users(SAML authenticated) list who searched for data under particular index(_internal) in the last 24hrs.

Re: List of users who searched data of an index

to4kawa — Sat, 16 May 2020 23:16:23 GMT

| tstats count where index=_audit TERM("_internal") by PREFIX("user=")

Re: List of users who searched data of an index

svelagala — Wed, 30 Sep 2020 05:25:53 GMT

I have used the query you have provided but it is not giving any results.
| tstats count where index=_audit TERM("_internal") by PREFIX("user=")

Also tried like this, but no use.
| tstats count where index=_audit by user

Re: List of users who searched data of an index

to4kawa — Sun, 17 May 2020 21:40:24 GMT

PREFIX() can work on splunk ver 8.
user is extracted at search time. so, you are not able to use with tstats
If your splunk version is ver 7.X:

index=_audit TERM("_internal") | stats count by user

It's faster when PREFIX can be used.

Re: List of users who searched data of an index

svelagala — Wed, 30 Sep 2020 05:27:46 GMT

Yes, it is 7.X for us.
index=_audit TERM("_internal") | stats count by user - this works good, but I would like to know the list of users based on index names.
For Example:
I would like to know the users who searched for all the index names ending with "_archive" like _internal_archive. if I run the below it is also giving wherever "_archive" is used, instead of not only in index names.
index=_audit TERM("*_archive") | stats count by user

Can you help me on this @to4kawa

Re: List of users who searched data of an index

to4kawa — Mon, 18 May 2020 09:48:34 GMT

index=_audit TERM("_internal") 
| stats count values(search) as search by user
| mvexpand search
| rex field=search "index=(?\S+)"
| eval index=trim(index,"\"")
| stats values(user) by index

Re: List of users who searched data of an index

svelagala — Wed, 30 Sep 2020 05:27:54 GMT

Above query almost worked but it is giving only results related to _internal index. Actually, I am looking for indexes ending with "_archive". Hence I tried in the below way.

let me know in case any optimization/better query can be provided @to4kawa

Re: List of users who searched data of an index

to4kawa — Mon, 18 May 2020 13:25:36 GMT

It is not profitable.

Re: List of users who searched data of an index

svelagala — Mon, 18 May 2020 14:03:11 GMT

Then what could be suitable query for my requirement @to4kawa