I created a report as like below for every 4 hours. But the problem is, Splunk does not sending the scheduled reports to email due the report size. when I download manually from "Searches, reports, and alerts", size of the csv report is approx 300MB. Is possible to schedule zip report ?
Account_Name=goc_*
This means i want user activity report for who started with the user account "goc_*
No, Out of the box Splunk can not send zipped emails.
You would need to build a custom alert to do this, or simply reduce the size(bytes) of the report it generates.
Either include fewer fields (using table), or fewer results (by scheduling more frequently)
However a 300MB report is HUGE, what on earth does it contain!?
I want to reduce the size of report and the report should be fewer fields (what user did on the data centre machines - Time, user name, Source IP/Host, destination IP/Host/Application, action Success/failure, what type of event is this - add, change, delete,execute ).
Could you please provide the code for "User Activity Report by using Splunk ".
Thanks in advance.
Can you provide a sample of the data the report contains, just a few rows, not the full 300 mb 🙂
Remember to remove anything sensitive.
Hi Nick,
Here the example of scheduled report by me.
Account_Name=goc_* process_name!="c:\windows\explorer.exe"
_time| Host|Account_name|ComputerName|Message|Action|Account_Domain|Process_Name|Eventtype|
3/12/19 1:33:48PM|DATAxx|xxxx|xxx.xx.net|An operation was attempted on a previlleged object.Subject, Security ID....| Success|xxx-NET|c:\programfiles\xx\xx.exe|Windows_previllged_object_operation|
Could you please help me to get this report simple, understandable and less size report.
Thanks in advance.
And I noticed there are many duplicate logs showing. same time stamp, same log showing in multiple times. How to avoid this?