Splunk Search

Can we get a query to fetch the savedsearches/dashboards which are running with timerange more than 24 hours

Naga
Engager

Can we get a query to fetch the savedsearches/dashboards which are running with timerange more than 24 hours

 

In oour search environment users are running the search in higher timeranges which is causing much load to our Infra. till it gets stabilized we wanted to allow users to run only searches within 24 hours not like Last 3 months / All time / Before This data kind of queries. So we wanted to filter such queries and inform the users. If its much critical we will allow them. Is there any way to pull like that?

Labels (2)
Tags (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Naga,

You can use below search to get this information from _audit logs;

index=_audit action=search info=granted search='* 
| eval StartTime=strptime(apiStartTime,"'%a %b %d %H:%M:%S %Y'"), EndTime=strptime(apiEndTime,"'%a %b %d %H:%M:%S %Y'") 
| eval TimeRange=round(EndTime-StartTime,0) 
| where TimeRange>86400
| eval TimeRange=replace(toString(TimeRange,"duration"),"\+"," days ")
| rex "\ssearch\=\'(?<SPL>[^\$]+)\',\sautojoin"
| table _time user TimeRange apiStartTime apiEndTime SPL
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...