Splunk Search

Data used by searches?

whitecat001
Explorer

I want a query that shows  the total volume of indexes used for splunk searches. Query on information that has to do with how much indexes are used based on splunk searches 

 
 
0 Karma

splunkreal
Motivator

Hello @whitecat001 try this :

index=_audit action="search" search="*" NOT user="splunk-system-user" savedsearch_name="" NOT search="\'|history*" NOT search="\'typeahead*"

| rex "index=(?P<myIndex>\w+)\s+\w+="

| stats count by myIndex

* If this helps, please upvote or accept solution if it solved *
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
That’s almost mission impossible with standard setup as you could do queries without defining any indexes into it. You could also use eventtypes etc. to hide real index names.
If you star to index all your search logs from sh side and look litesearch part then that could give to you more accurate index list?
r. Ismo
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...