Splunk Search

How can I get the app name where the user searches are run

pradeepkumarg
Influencer

I want to get the app name where the users have run their searches eg: search, myapp1, myapp2

index=_audit action=search

I Couldn't get much information on the app from the above logs

Tags (3)
0 Karma

Drainy
Champion

Something like this will give you a count of the searches a user has initiated per app (including ad-hoc dashboard ones);
index=_internal sourcetype="splunk_web_access" client_app="*" | stats count by user,client_app

If you want to pull searches out too you could write a regex to get the part you need out.

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...