| History & User

[behymejt2012]

Hi Everyone,

Utilizing | History to show all the Jobs running/completed is great, but I am unable to make a connection to who actually started the Job.

Does anyone have any suggestions to see what searches where performed by a user?

Thanks!

[aholzer]

Try using the index=_audit instead of "| history".

The _audit index contains a user field, an action field (that you should set to action=search, to only look at searches) and should show you the search run in the "search" field.

Something like:
index=_audit action=search search=* | table _time, search, user

You can also run stats and the like once you get the base search down.

Hope this helps.

[martin_mueller]

The history command only looks at your own past searches, it's what is used to compute the suggestions of recent searches that come up when you type.

In order to look at other users' searches you can inspect the _audit index. There are some pre-built searches in the SoS app, you can work your way from there or just start browsing the index, look for the field search - maybe saved_search as well.