Other Usage

Rest API request to fetch Audit logs in Splunk Enterprise security

Chandrashekharg
Engager

We are looking for API request which fetch the audit logs/events performed by users in various application

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

unfortunately (at least I don't know) that there is separate endpoints to get splunk audit logs.

But you could get those by using search endpoint. https://docs.splunk.com/Documentation/Splunk/9.1.2/RESTREF/RESTsearch

Just create some saved searches which give you needed information and then call those or use ad hoc queries over REST api.

r. Ismo

Get Updates on the Splunk Community!

Detector Best Practices: Static Thresholds

Introduction In observability monitoring, static thresholds are used to monitor fixed, known values within ...

Expert Tips from Splunk Education, Observability in Action, Plus More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Changes to Splunk Instructor-Led Training Completion Criteria

We’re excited to share an update to our instructor-led training program that enhances the learning experience ...