User audit report

[mcrouse]

Hello, I am enhancing an existing Splunk instance and I want to build or find a report that will tell me who accessed the system and when, and what searches or reports they ran. Is there a canned report that will tell me this information? If not, can someone help me define the search to turn up this information? Thanks.

[somesoni2]

You may want to look at the reports provided by SOS (splunk-on-splunk) app. They have reports with data like "UI Search Activity by User","Recent Usage by User (Non-Scheduled Only)"

[lguinn2]

This may be close to what you want:

index=_audit action=search search=* NOT "typeahead" NOT metadata NOT "|history" NOT "AUTOSUMMARY" 

You may want to play around with it to include/eliminate certain searches.

[splunkn]

Hi Iguinn. Its a good answer. Could you please explain you have eliminated few words like typeahead metadata history and autosummary. I am able see the differences but am not able to understand the exact purpose

Thanks in advance