Security

How can I get the details about the queries run by user

Influencer

I want to know the details of the queries issued by users.

index=_internal sourcetype="searches"

This only gives me the search query and not earliest,latest,run_time. Is there a way to get these details?

Tags (3)
1 Solution

Revered Legend

You can try following query.

index=_audit action=search info=completed

This will give you fields like user, total run time,result count, time when search was executed, search time range and variety of other information.

Cheers.

View solution in original post

Revered Legend

You can try following query.

index=_audit action=search info=completed

This will give you fields like user, total run time,result count, time when search was executed, search time range and variety of other information.

Cheers.

View solution in original post

Motivator

Hello

In the default search app, you have a few reports with search user activity, you can found them in:

Status\Search Activity\

In particular: Search Activity per user.

In addition to those reports, you have even more in the SOS app that you can download from apps.splunk.com

Regards

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!