User Activity Report? It is not Splunk console user activity report.

[brpsingara]

I created a report as like below for every 4 hours. But the problem is, Splunk does not sending the scheduled reports to email due the report size. when I download manually from "Searches, reports, and alerts", size of the csv report is approx 300MB. Is possible to schedule zip report ?

Account_Name=goc_*

This means i want user activity report for who started with the user account "goc_*

[nickhills]

No, Out of the box Splunk can not send zipped emails.
You would need to build a custom alert to do this, or simply reduce the size(bytes) of the report it generates.
Either include fewer fields (using table), or fewer results (by scheduling more frequently)

However a 300MB report is HUGE, what on earth does it contain!?

[brpsingara]

I want to reduce the size of report and the report should be fewer fields (what user did on the data centre machines - Time, user name, Source IP/Host, destination IP/Host/Application, action Success/failure, what type of event is this - add, change, delete,execute ).

Could you please provide the code for "User Activity Report by using Splunk ".

Thanks in advance.

[nickhills]

Can you provide a sample of the data the report contains, just a few rows, not the full 300 mb 🙂

Remember to remove anything sensitive.

[brpsingara]

Hi Nick,

Here the example of scheduled report by me.

Account_Name=goc_* process_name!="c:\windows\explorer.exe"

_time| Host|Account_name|ComputerName|Message|Action|Account_Domain|Process_Name|Eventtype|

3/12/19 1:33:48PM|DATAxx|xxxx|xxx.xx.net|An operation was attempted on a previlleged object.Subject, Security ID....| Success|xxx-NET|c:\programfiles\xx\xx.exe|Windows_previllged_object_operation|

Could you please help me to get this report simple, understandable and less size report.

Thanks in advance.

[brpsingara]

And I noticed there are many duplicate logs showing. same time stamp, same log showing in multiple times. How to avoid this?