topic Get user's search history in Splunk Search

Get user's search history

nawazns5038 — Tue, 27 Feb 2018 01:46:22 GMT

Is there a way to get the user search activity excluding the searches given the dashboards

Thanks
N

adonio — Tue, 27 Feb 2018 01:56:20 GMT

hello there,

start with: index=_audit action=search user=yourUser
many answers here with tips and variations for example:
https://answers.splunk.com/answers/49089/is-it-possible-to-monitor-splunk-user-activity.html
https://answers.splunk.com/answers/225682/how-to-search-splunks-internal-audit-events-to-see.html
https://answers.splunk.com/answers/77551/splunk-user-activity.html
or use your favorite search engine and try combinations like: "splunk track user activity"
also, i think that there are couple apps around this topic.

hope it helps

niketn — Tue, 27 Feb 2018 19:58:49 GMT

@nawazns5038, I have added comments to @MuS 's answer below.

Please try out and confirm!

nawazns5038 — Wed, 28 Feb 2018 23:08:58 GMT

Yes, looks like its working .

Thanks !