Splunk Search

Determining user search timeframes



Is there anyway to determine what timeframes (24 hours, 7 days, 15 minutes...) are being used for searches in Splunk? I want to use that as criteria for data retention policy.

Tags (1)
0 Karma

Revered Legend

You can get various information about searches executed from _audit index. A sample search which provides period used in the search could be like below:

index=_audit action=search info="completed"
|eval period=search_lt-search_et
|eval ExecutionTime=strftime(exec_time,"%Y-%m-%d %H:%M")
|eval StartTime=strftime(search_et,"%Y-%m-%d %H:%M")
|eval EndTime=strftime(search_lt,"%Y-%m-%d %H:%M")
|eval searchDuration=case(period < 60,round(period)." sec",period <3600,round(period/60)." Min",period <86400,round(period/3600)." Hr",1=1,round(period/86400)." Days")
|eval suffix=" from "+StartTime
|eval searchDuration=case(ExecutionTime=EndTime,"Last "+searchDuration,1=1,searchDuration+suffix)
|table user , ExecutionTime,StartTime ,EndTime ,period,searchDuration

You can customize similar queries as per your requirement.

Splunk Employee
Splunk Employee

Yes, searches and information about them are recorded in audit.log (which is by default indexed into the _internal index).

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!