How to write a Splunk audit search?

sulaimancds · ‎03-02-2023

hi,

i need to create a query or where can i find this information.

i want the list of users who has run queries , for auditing purpose ,with the keyword PII on those queries which was run.

Please help.

inventsekar · ‎03-02-2023

Hi @sulaimancds .. the _audit index will have all splunk user's search commands (search history).

please check this:

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !