Splunk Search

How Splunk admin can find a search executed by user which causing SearchResults - Corrupt csv header, 2 columns with the same name '__mv_Calling_Station_Identifier' (col #xx and #xxx, #xxx will be ignored)

anilyelmar
Explorer

How Splunk admin can find a search executed by user which causing SearchResults - Corrupt csv header, 2 columns with the same name '__mv_Calling_Station_Identifier' (col #xx and #xxx, #xxx will be ignored)

Tags (1)
0 Karma

dkeck
Influencer

Hi,

I am not sure I get your question, but if you ask where you can find executed searches in splunkd log. then have a look at

index=_audit action="search" search=* NOT user="splunk-system-user"

also refer to

https://answers.splunk.com/answers/151378/why-history-command-only-shows-my-searches-not-searches-ru...

Please accept the answer if it was helpful thank you 🙂

0 Karma

anilyelmar
Explorer

thanks , let me clarify my question: I do see a lot of errors in my search head internal logs as "SearchResults - Corrupt csv header, 2 columns with the same name '__mv_Calling_Station_Identifier' (col #xx and #xxx, #xxx will be ignored)" which means I have some users running ad-hoc/scheduled searches and resulting duplicate field names like ...|fields a b c a d b e ( here a and b are duplicated unnecessary)
I have hundreds of users running thousands of searches daily and its impossible to look manually each of them for above issue) I am looking a way to identify those users and their search strings.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...