https://community.splunk.com/t5/Splunk-Search/How-to-search-user-search-history-by-keyword/m-p/312755#M93638 <P>Yes, it is in the internal audit index.</P> <P><CODE>index=_audit action=search search=*apple* | table _time,user,search</CODE></P> Fri, 01 Sep 2017 18:05:07 GMT skoelpin 2017-09-01T18:05:07Z https://community.splunk.com/t5/Splunk-Search/How-to-search-user-search-history-by-keyword/m-p/312754#M93637 <P>Hi there,</P> <P>Is there any way to find out who are the users queried for a particular word in Splunk? For example, i would like to find out all the users who queried for a word called "apple" or whose queries contain a word "apple" . </P> <P>Thank you</P> Fri, 01 Sep 2017 17:54:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-user-search-history-by-keyword/m-p/312754#M93637 kteng2024 2017-09-01T17:54:32Z https://community.splunk.com/t5/Splunk-Search/How-to-search-user-search-history-by-keyword/m-p/312755#M93638 <P>Yes, it is in the internal audit index.</P> <P><CODE>index=_audit action=search search=*apple* | table _time,user,search</CODE></P> Fri, 01 Sep 2017 18:05:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-user-search-history-by-keyword/m-p/312755#M93638 skoelpin 2017-09-01T18:05:07Z https://community.splunk.com/t5/Splunk-Search/How-to-search-user-search-history-by-keyword/m-p/312756#M93639 <P>If you are able to see the _audit index (usually that means that you have admin priviledges), you can search the content of user searches.</P> <P>Something like</P> <PRE><CODE>index=_audit sourcetype=audittrail action=search user!="splunk-system-user" "search=" YOURWORDHERE </CODE></PRE> <P>should work.</P> <P>Just be aware that the search you just ran will also show up in the list! <span class="lia-unicode-emoji" title=":grinning_face_with_smiling_eyes:">😄</span></P> Fri, 01 Sep 2017 18:09:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-user-search-history-by-keyword/m-p/312756#M93639 lguinn2 2017-09-01T18:09:43Z https://community.splunk.com/t5/Splunk-Search/How-to-search-user-search-history-by-keyword/m-p/312757#M93640 <P>Thank you for the reply.. but for some the searches i don't see the userID . </P> Fri, 01 Sep 2017 18:13:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-user-search-history-by-keyword/m-p/312757#M93640 kteng2024 2017-09-01T18:13:51Z https://community.splunk.com/t5/Splunk-Search/How-to-search-user-search-history-by-keyword/m-p/312758#M93641 <P>There should be a field called user, is it showing up as a blank column?</P> Fri, 01 Sep 2017 18:46:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-user-search-history-by-keyword/m-p/312758#M93641 skoelpin 2017-09-01T18:46:09Z