https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-and-identify-the-top-users-of-each/m-p/242442#M72125 <P>I'm sluggish today <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> This is what I wanted to use (indexname - the extracted field). Updated the answer as well.</P> Tue, 11 Oct 2016 15:52:36 GMT somesoni2 2016-10-11T15:52:36Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-and-identify-the-top-users-of-each/m-p/242437#M72120 <P>Wondering if there is a way to identify top user of each index. Basically I am tasked with going back and identifying the use cases for each index in our environment, and I feel that the best way of doing so is to contact the users who search the respective indexes the most.</P> <P>Thanks!!</P> Tue, 11 Oct 2016 14:23:01 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-and-identify-the-top-users-of-each/m-p/242437#M72120 paimonsoror 2016-10-11T14:23:01Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-and-identify-the-top-users-of-each/m-p/242438#M72121 <P>Hi paimonsoror, </P> <P>Not sure if I understand your question correctly, but if you want to get detailed usage information about indexes, follow these steps: </P> <OL> <LI>From the Splunk Web menu, select <STRONG>Settings &gt; Monitoring Console</STRONG>. </LI> <LI>From the Monitoring Console menu, select <STRONG>Indexing &gt; Indexes and Volumes &gt; Indexes and Volumes: Instance</STRONG>. </LI> <LI>You can view usage information of all your indexes and drill down to see details as needed. </LI> </OL> <P>Hope it helps. Thanks!<BR /> Hunter Shen</P> Tue, 11 Oct 2016 15:06:02 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-and-identify-the-top-users-of-each/m-p/242438#M72121 hunters_splunk 2016-10-11T15:06:02Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-and-identify-the-top-users-of-each/m-p/242439#M72122 <P>Thanks for the response @hunters_splunk. Basically I am looking to answer the question:</P> <P>"For Index XYZ, User ABC runs the most queries against it"</P> Tue, 11 Oct 2016 15:12:19 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-and-identify-the-top-users-of-each/m-p/242439#M72122 paimonsoror 2016-10-11T15:12:19Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-and-identify-the-top-users-of-each/m-p/242440#M72123 <P>You can search the _audit logs to see the user searches and try to figure out index details from there. Following query should give you top user for each index.</P> <P><STRONG>Updated</STRONG></P> <PRE><CODE>index=_audit action=search search=* user=*| rex field=search "index\s*=\s*\"*(?&lt;indexname&gt;[^\s\"]+)" | stats count by indexname user | sort 0 indexname -count | dedup indexname </CODE></PRE> <P>Now the problem with this query is it searches what users are running in Splunk, and often user don't specify index names (which they should to get best performance) in their searches. Above will not count for those searches. See if this can be useful for you with that limitation.</P> Tue, 11 Oct 2016 15:34:39 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-and-identify-the-top-users-of-each/m-p/242440#M72123 somesoni2 2016-10-11T15:34:39Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-and-identify-the-top-users-of-each/m-p/242441#M72124 <P>This is awesome, except it looks like it only return a one liner for me that only showed the index as _audit.</P> <P>I got some results by running the slight changes here, not sure if it is what you intended, but it certainly gives me a starting point:</P> <PRE><CODE>index=_audit action=search search=* user=*| rex field=search "index\s*=\s*\"*(?&lt;indexname&gt;[^\s\"]+)" | stats count by indexname user | sort 0 indexname -count | dedup indexname </CODE></PRE> Tue, 11 Oct 2016 15:50:04 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-and-identify-the-top-users-of-each/m-p/242441#M72124 paimonsoror 2016-10-11T15:50:04Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-and-identify-the-top-users-of-each/m-p/242442#M72125 <P>I'm sluggish today <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> This is what I wanted to use (indexname - the extracted field). Updated the answer as well.</P> Tue, 11 Oct 2016 15:52:36 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-and-identify-the-top-users-of-each/m-p/242442#M72125 somesoni2 2016-10-11T15:52:36Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-and-identify-the-top-users-of-each/m-p/242443#M72126 <P>Wouldn't this only work if the user manually specified the index name in the search query? Users would have to specify it if the index were only allowed and not the default.</P> Tue, 30 Apr 2019 15:59:16 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-and-identify-the-top-users-of-each/m-p/242443#M72126 vcarbona 2019-04-30T15:59:16Z