Security

How can I get the details about the queries run by user

pradeepkumarg
Influencer

I want to know the details of the queries issued by users.

index=_internal sourcetype="searches"

This only gives me the search query and not earliest,latest,run_time. Is there a way to get these details?

Tags (3)
1 Solution

somesoni2
Revered Legend

You can try following query.

index=_audit action=search info=completed

This will give you fields like user, total run time,result count, time when search was executed, search time range and variety of other information.

Cheers.

View solution in original post

somesoni2
Revered Legend

You can try following query.

index=_audit action=search info=completed

This will give you fields like user, total run time,result count, time when search was executed, search time range and variety of other information.

Cheers.

gfuente
Motivator

Hello

In the default search app, you have a few reports with search user activity, you can found them in:

Status\Search Activity\

In particular: Search Activity per user.

In addition to those reports, you have even more in the SOS app that you can download from apps.splunk.com

Regards

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...