How can I search for all users who can access Splunk AND a log of their login/logout info and searches?

[anandhalagarasa]

How to retrieve list of users with access to the Splunk tool and then access logs related to who is logging in and out of the Splunk tool. Also, logs related to functions being performed on the Splunk tool.

Is there any search query to retrieve those details since its required by auditors for verification purpose.

[anandhalagarasa]

Exact Question is:

Need the list of users with access to the Splunk tool and then access logs related to who is coming in and out of the tool. Also, logs related to functions being performed on the Splunk tool.
Also, can you point the specific page number where you feel the policy and process requirements are covered for this control? It may be that policy needs to move to 75% if you don't specifically speak to protecting access to audit tools. The process can stay at 100% since it would likely just follow you audit and access control standards

[gcusello]

Hi anandhalagarasan,
have you seen the "Data Governance" ( https://splunkbase.splunk.com/app/1866/ ) and "Search Activity" ( https://splunkbase.splunk.com/app/2632/ ) Apps?
There are some panels that describe user search activities.

Anyway in _audit index there are all the information about user activities on Splunk.

Bye.
Giuseppe

[anandhalagarasa]

Is there any search query to pull who and all logged in & logged out in Splunk for last 24 hours . Also logs being performed on Splunk tool.

This is just an example.

[anandhalagarasa]

Can anyone kindly help on this request.

[gcusello]

Try something like this

(index=_audit sourcetype=audittrail login) OR ( index=_internal sourcetype=splunk_web_service logout) action!=search 
| eval type=if(sourcetype="audittrail","Login","Logout")
| table _time user type

Bye.
Giuseppe