Splunk Search

Can an ausearch command be used in the search field?

amortiz
Explorer

I am attempting to convert a audit script on my linux audit server into something manageable in Splunk.
Can I use the commands from the script in Splunk?

An ausearch example is below.
- ausearch –k logins and ausearch –m USER_LOGIN

Tags (4)
0 Karma

lukejadamec
Super Champion

No, ausearch is a unix command. What you can do is write a script that uses ausearch to monitor the audit logs, and have that output indexed. The TA_for_Nix app does that with rlog.sh script.

Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...