Dashboards & Visualizations

How can I see who viewed the results in a dashboard or search?

dcrooks_cbp
New Member

How can I see who viewed the results in a dashboard or search? I need to know what weblog or audit log info would look like when a user views the results of a search.

0 Karma

DalJeanis
Legend

Rather than hand you a fish, I'm going to teach you how to catch this particular type. (Or any particular type of fish, by varying the bait you use.)

First, go look at the dashboard yourself and run that search. Now you know one person who has done so, and you know exactly what time they did and what their user id is, because it's you, and you did it just now.

Second, wait for about five minutes. This lag is so that when you start searching, your new searches that have some of the same key words that you are looking for will not show up in your results.

Third, go look at index=_audit for your userid in a fixed date and time range at that exact time plus a minute before and a minute after. Chances are pretty good, you'll see the exact record you were looking for. If not, then search for your IP address at that time, or look for the name of the saved search that the dashboard runs, or if there is no name for that search in the dash, then look for some of the specific SPL that is executed.

Once you know how to catch the fish you just threw in, widen your net and look for at least one more fish of the same type. That proves you haven't tightened your requirements too much.

Any of the above steps will help you find the records in the wild that match the tame fish that you threw in for practice.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...