Can an ausearch command be used in the search field?

[amortiz]

I am attempting to convert a audit script on my linux audit server into something manageable in Splunk.
Can I use the commands from the script in Splunk?

An ausearch example is below.
- ausearch –k logins and ausearch –m USER_LOGIN

[lukejadamec]

No, ausearch is a unix command. What you can do is write a script that uses ausearch to monitor the audit logs, and have that output indexed. The TA_for_Nix app does that with rlog.sh script.