Splunk Report Audit Report

[dejul]

Hi all, is it possible to have a report run in Splunk which reports on which reports have been run in Splunk and who ran the report.

[David]

You can also audit searches in general and understand what users are doing with focused apps, such as one I built: Search Activity

[woodcock]

In older versions of Splunk, you do it like this:

index=_internal sourcetype=searches |stats values(_raw) BY username

But starting in v5, you use the history command:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/History