Determining user search timeframes

[a212830]

Hi,

Is there anyway to determine what timeframes (24 hours, 7 days, 15 minutes...) are being used for searches in Splunk? I want to use that as criteria for data retention policy.

[somesoni2]

You can get various information about searches executed from _audit index. A sample search which provides period used in the search could be like below:

index=_audit action=search info="completed"
|eval period=search_lt-search_et
|eval ExecutionTime=strftime(exec_time,"%Y-%m-%d %H:%M")
|eval StartTime=strftime(search_et,"%Y-%m-%d %H:%M")
|eval EndTime=strftime(search_lt,"%Y-%m-%d %H:%M")
|eval searchDuration=case(period < 60,round(period)." sec",period <3600,round(period/60)." Min",period <86400,round(period/3600)." Hr",1=1,round(period/86400)." Days")
|eval suffix=" from "+StartTime
|eval searchDuration=case(ExecutionTime=EndTime,"Last "+searchDuration,1=1,searchDuration+suffix)
|table user , ExecutionTime,StartTime ,EndTime ,period,searchDuration

You can customize similar queries as per your requirement.

[gkanapathy]

Yes, searches and information about them are recorded in audit.log (which is by default indexed into the _internal index).