Archive

User Activity Report? It is not Splunk console user activity report.

Explorer

I created a report as like below for every 4 hours. But the problem is, Splunk does not sending the scheduled reports to email due the report size. when I download manually from "Searches, reports, and alerts", size of the csv report is approx 300MB. Is possible to schedule zip report ?

AccountName=goc*

This means i want user activity report for who started with the user account "goc_*

Tags (1)
0 Karma

Ultra Champion

No, Out of the box Splunk can not send zipped emails.
You would need to build a custom alert to do this, or simply reduce the size(bytes) of the report it generates.
Either include fewer fields (using table), or fewer results (by scheduling more frequently)

However a 300MB report is HUGE, what on earth does it contain!?

0 Karma

Explorer

I want to reduce the size of report and the report should be fewer fields (what user did on the data centre machines - Time, user name, Source IP/Host, destination IP/Host/Application, action Success/failure, what type of event is this - add, change, delete,execute ).

Could you please provide the code for "User Activity Report by using Splunk ".

Thanks in advance.

0 Karma

Ultra Champion

Can you provide a sample of the data the report contains, just a few rows, not the full 300 mb 🙂

Remember to remove anything sensitive.

0 Karma

Explorer

Hi Nick,

Here the example of scheduled report by me.

AccountName=goc* process_name!="c:\windows\explorer.exe"

time| Host|Accountname|ComputerName|Message|Action|AccountDomain|ProcessName|Eventtype|

3/12/19 1:33:48PM|DATAxx|xxxx|xxx.xx.net|An operation was attempted on a previlleged object.Subject, Security ID....| Success|xxx-NET|c:\programfiles\xx\xx.exe|Windowsprevillgedobject_operation|

Could you please help me to get this report simple, understandable and less size report.

Thanks in advance.

0 Karma

Explorer

And I noticed there are many duplicate logs showing. same time stamp, same log showing in multiple times. How to avoid this?

0 Karma