Security

Can I get Splunk user activity alerts that include dashboard used?

nick405060
Motivator

Current:
index=_audit user!="splunk-system-user" user!="n/a" user!="MYUSER" user!=testuser* (action="login attempt") OR (search!="" search_id!="'scheduler*" search_id!="scheduler*" search_id!="'subsearch*") | sort - _time | table user host action info search _time

Works well, but many times searches are similar across dashboards and I can't easily tell what dashboard my users are using. Is it possible to add dashboard_name to these alerts? I don't see it anywhere in the _raw for these events in _audit. Currently the only solution I can think of is to mod every back-end search (probably a hundred of them across all my dashboards) with the dashboard name so it can be rexed out... obviously that's an incredibly inelegant approach

0 Karma
1 Solution

PowerPacked
Builder

Hi

for dashboard usage activity

Please use this search, the results also gives user name as well alt text

in the above search "my_test" is dashboard's name which you see in URL when you open the dashboard.

Thanks

View solution in original post

PowerPacked
Builder

Hi

for dashboard usage activity

Please use this search, the results also gives user name as well alt text

in the above search "my_test" is dashboard's name which you see in URL when you open the dashboard.

Thanks

nick405060
Motivator

GREAT. I modded it to make a bit more usable/readable, and added it to my _audit search, to make my overall user_activity alert be:

(index=_internal sourcetype=splunkd_ui_access uri_path="/en-US/app*") OR (index=_audit AND action="login attempt" OR (search!="" search_id!="'scheduler*"  search_id!="scheduler*" search_id!="'subsearch*")) user!="splunk-system-user" user!="n/a" user!="ME" user!=testuser* | eval sortable_time=_time | eval time=strftime(sortable_time,"%Y-%m-%d %H:%M:%S") |
streamstats count as temp_count | stats values(*) as * by temp_count | fields - temp_count | table time user action info search clientip uri_path file earliest latest form_*  | fields - _raw form_message_id form_remote_search_tok
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...