Splunk Search

How do I find out how many times an offensive search ran in the past day/week?

ddrillic
Ultra Champion

We have, what we believe to be an offensive search. How can we find out how many times it ran recently and by whom?

Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Is it a saved search or adhoc search?? If saved search, look at index=_internal sourcetypes=scheduler savedsearch_name=YourSearchName. For adhoc searches, check index=_audit.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Is it a saved search or adhoc search?? If saved search, look at index=_internal sourcetypes=scheduler savedsearch_name=YourSearchName. For adhoc searches, check index=_audit.

ddrillic
Ultra Champion

Gorgeous !!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...