Splunk Search

Counting Your searches

carmackd
Communicator

Is there anyway to count the number of searches ran on an indexer in a 24 hour period?

Tags (2)
0 Karma
2 Solutions

ftk
Motivator

The following gives you a total for all adhoc searches run in the past 24 hours:

index=_internal sourcetype="searches" earliest=-24h | stats count

And this one will give you a total for all searches, including saved searches run in the past 24 hours:

index=_internal (sourcetype="searches" OR SavedSplunker) earliest=-24h | stats count

And individual counts by user:

index=_internal (sourcetype="searches" OR SavedSplunker) earliest=-24h | stats count by user

View solution in original post

hulahoop
Splunk Employee
Splunk Employee

In the Search App in the Status > Search activity dashboards in Splunk 4.1.x there are dashboards containing the following searches:

Search load over time (last 24 hours)
Search count by user (last 24 hours)
Run time by user (last 24 hours)
Common searches (last hour)
CPU Utilization due to searches
etc.

If you have SplunkWeb running on the indexer these dashboards will display results for that indexer. I'm not sure if these dashboards are built out of the box for distributed search though.

View solution in original post

hulahoop
Splunk Employee
Splunk Employee

In the Search App in the Status > Search activity dashboards in Splunk 4.1.x there are dashboards containing the following searches:

Search load over time (last 24 hours)
Search count by user (last 24 hours)
Run time by user (last 24 hours)
Common searches (last hour)
CPU Utilization due to searches
etc.

If you have SplunkWeb running on the indexer these dashboards will display results for that indexer. I'm not sure if these dashboards are built out of the box for distributed search though.

ftk
Motivator

The following gives you a total for all adhoc searches run in the past 24 hours:

index=_internal sourcetype="searches" earliest=-24h | stats count

And this one will give you a total for all searches, including saved searches run in the past 24 hours:

index=_internal (sourcetype="searches" OR SavedSplunker) earliest=-24h | stats count

And individual counts by user:

index=_internal (sourcetype="searches" OR SavedSplunker) earliest=-24h | stats count by user
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...