All Apps and Add-ons

App/User Role with the highest number of queries running or running

markuxProof
Path Finder

Greetings,

I'm trying to perform a search that shows me a list of top apps / roles that most perform queries. I'm trying to hold rest queries to get this information but I'm not getting it.

Someone has a suggestion?

Tkx.

0 Karma

PowerPacked
Builder

Hi @markuxProof

Splunk writes data about top apps, top users in Introspection Index

Hope this helps,

alt text

Thanks

0 Karma

yannK
Splunk Employee
Splunk Employee

For the search per app you can easily tell from the monitoring console app.

https://mysplunkinstance:8000/en-US/app/splunk_monitoring_console/search_activity_instance

the panels are populated by searches based on introspection. (it has the type of search, app, user, mode , search name...)
but the role is not included, you may have to do a lookup (for the user/role mapping), but remember that an user can be member of several roles, and that roles inherit from each others, so you may not have a 1-1 relation ....

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>