Reporting

How to get a list of reports and searches run by a specific user?

Champion

Hi,

I need a report that shows what searches and scheduled reports that a user has run over a timeframe. I thought it was in the DMC, but I don't see it. Can someone help me?

0 Karma
1 Solution

Builder
index=_audit action=search search=* NOT "typeahead" NOT metadata NOT " | history" NOT "AUTOSUMMARY" | table _time, user, search

You can reduce that to a specific user:

index=_audit action=search search=* NOT "typeahead" NOT metadata NOT " user=${user_of_interest} | history" NOT "AUTOSUMMARY" | table _time,  search

View solution in original post

Ultra Champion

Manage search jobs may also be of interest given the formatting and filtering already implemented for you.

0 Karma

Builder

Except......that report will only contain the jobs that haven't expired. Its based on the artifacts in the dispatch directory I believe. To get historic data, you would need to use logs.

0 Karma

Builder
index=_audit action=search search=* NOT "typeahead" NOT metadata NOT " | history" NOT "AUTOSUMMARY" | table _time, user, search

You can reduce that to a specific user:

index=_audit action=search search=* NOT "typeahead" NOT metadata NOT " user=${user_of_interest} | history" NOT "AUTOSUMMARY" | table _time,  search

View solution in original post

Builder

Correct a terrible paste accident in the "specific user" search syntax above:

index=_audit action=search search=* user=${user_of_interest} NOT "typeahead" NOT metadata NOT " | history" NOT "AUTOSUMMARY" | table _time, search

0 Karma

Champion

thanks!

0 Karma