Splunk Search

How can I get the app name where the user searches are run

pradeepkumarg
Influencer

I want to get the app name where the users have run their searches eg: search, myapp1, myapp2

index=_audit action=search

I Couldn't get much information on the app from the above logs

Tags (3)
0 Karma

Drainy
Champion

Something like this will give you a count of the searches a user has initiated per app (including ad-hoc dashboard ones);
index=_internal sourcetype="splunk_web_access" client_app="*" | stats count by user,client_app

If you want to pull searches out too you could write a regex to get the part you need out.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...