topic how do i get a list of all searches performed in splunk? in Splunk Search

how do i get a list of all searches performed in splunk?

ytl — Thu, 25 Sep 2014 07:47:15 GMT

can someone help me with a query to provide me a table of _time, user, search string of all queries performed in splunk please?

Re: how do i get a list of all searches performed in splunk?

MuS — Thu, 25 Sep 2014 07:58:29 GMT

Hi ytl,

you need to have read access to index=_audit and run something like this:

index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" | stats count by user search _time | sort _time | convert ctime(_time) | stats list(_time) as time list(search) as search by user

if this does not match your needs, adapt this search.

Hope this helps ...

cheers, MuS

Re: how do i get a list of all searches performed in splunk?

MuS — Thu, 25 Sep 2014 08:38:06 GMT

as addition:

If you're on Splunk 6.x you can open this URL and get the same:

http[s]://YourSplunkServerName:YourSplunkWebPort/app/search/status_index

Re: how do i get a list of all searches performed in splunk?

nawazns5038 — Tue, 27 Feb 2018 01:41:29 GMT

how to exclude the searches obtained from a dashboard ?

Re: how do i get a list of all searches performed in splunk?

niketn — Tue, 27 Feb 2018 19:57:34 GMT

@nawazns5038, if your intent is to find only the searches which are run through Splunk UI, you can try the following:

index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=sourcetypes | search totalCount > 0"
| stats count by _time user search savedsearch_name  
| where savedsearch_name=""
| fields - savedsearch_name

PS: savedsearch_name will be given to saved searches and dashboard searches not for the searches run via UI.