How to write a Splunk audit search? - Splunk Community

Splunk Enterprise Security

hi,

i need to create a query or where can i find this information.

i want the list of users who has run queries , for auditing purpose ,with the keyword PII on those queries which was run.

Please help.

Hi @sulaimancds .. the _audit index will have all splunk user's search commands (search history).

please check this:

https://community.splunk.com/t5/Splunk-Search/Get-user-s-search-history/m-p/57744

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...