I have to extract in csv all the searches that are performed in an hour from minute 1 to minute 60 and runs at what minute . Any help will be appreciated

Tags (1)
0 Karma

Esteemed Legend

I don't understand what you trying to do (try using a body with details next time, not just the subject) but this search should get you started (you do not need two asterisks at the end; I could not get markdown to give me just one):

index=_internal sourcetype=*searches**
index=_internal sourcetype=*searches** | stats values(_raw) by date_minute

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...