https://community.splunk.com/t5/Splunk-Search/Can-an-ausearch-command-be-used-in-the-search-field/m-p/107598#M27970 <P>No, ausearch is a unix command. What you can do is write a script that uses ausearch to monitor the audit logs, and have that output indexed. The TA_for_Nix app does that with rlog.sh script.</P> Mon, 28 Sep 2020 15:01:43 GMT lukejadamec 2020-09-28T15:01:43Z https://community.splunk.com/t5/Splunk-Search/Can-an-ausearch-command-be-used-in-the-search-field/m-p/107597#M27969 <P>I am attempting to convert a audit script on my linux audit server into something manageable in Splunk.<BR /> Can I use the commands from the script in Splunk?</P> <P>An ausearch example is below.<BR /> - ausearch –k logins and ausearch –m USER_LOGIN</P> Mon, 21 Oct 2013 14:14:18 GMT https://community.splunk.com/t5/Splunk-Search/Can-an-ausearch-command-be-used-in-the-search-field/m-p/107597#M27969 amortiz 2013-10-21T14:14:18Z https://community.splunk.com/t5/Splunk-Search/Can-an-ausearch-command-be-used-in-the-search-field/m-p/107598#M27970 <P>No, ausearch is a unix command. What you can do is write a script that uses ausearch to monitor the audit logs, and have that output indexed. The TA_for_Nix app does that with rlog.sh script.</P> Mon, 28 Sep 2020 15:01:43 GMT https://community.splunk.com/t5/Splunk-Search/Can-an-ausearch-command-be-used-in-the-search-field/m-p/107598#M27970 lukejadamec 2020-09-28T15:01:43Z