How to explain follow _audit log?

xiyangyang — Tue, 23 Aug 2022 07:40:35 GMT

I found follow logs in _audit logs. The user who run this search cannot access internal logs, so I assume the underline part is added by Splunk system.

Could anyboda explain follow 2 questions?

What does the underline part mean?

what does the field _cd mean?

search='search (index=* OR index=_*) _time>=1661000447 _time<1661000460 host="XXX" source="XXX" | eval _DBID = replace(_cd, "(\d+):\d+", "\1") | eval _OFFSET = replace(_cd, "\d+:(\d+)", "\1")']

Re: How to explain follow _audit log?

richgalloway — Tue, 23 Aug 2022 12:09:29 GMT

The underscore in an index or field name is just part of the name, however, names beginning with an underscore are reserved for use by Splunk.

The _cd field gives the location of an event within an index. See https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Knowledge/Usedefaultfields#_cd for details.

topic How to explain follow _audit log? in Splunk Search

How to explain follow _audit log?

Re: How to explain follow _audit log?