Dashboards & Visualizations

How to create a dashboard to show the use activity

Mfmahdi
Path Finder

How to create a dashboard to show the activities of the users specially uploading files. Kindly

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Can you find by looking through your logs any data which indicates the behaviour you are looking for?

View solution in original post

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@Mfmahdi - You can start by searching below into your internal logs, which has both file names that were uploaded and user names who uploaded it.

index=_internal "/services/receivers/stream"

 

From here you have to first complete the search query and click on save as dashboard from your search page.

 

I hope this helps!!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What events have you ingested into Splunk?

0 Karma

Mfmahdi
Path Finder

we logs from linux and windows but most of our servers they are linux @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some anonymised examples of the events you are interested in

0 Karma

Mfmahdi
Path Finder

I 'm not allowed to search any logs. but what we are looking for is a dashboard that show is any user is uploading files in our environment @ITWhisperer  

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How do you propose to detect whether a file has been uploaded if you don't have access to any logs?

Please describe your environment in a bit more detail and what capabilities you do have.

0 Karma

Mfmahdi
Path Finder

we do have access to all the logs, we have PowerShell , sysmon and linux ...

we need to know is any user is uploading file through PowerShell or sysmon or any data source that usually the SOC can monitor. we need to create a dashboard that shows any files activity @ITWhisperer thank you in advance 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you find by looking through your logs any data which indicates the behaviour you are looking for?

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...