Splunk Search

How do we find events on indexers wise in splunk

mputtam
Path Finder

Hi Community,

I was trying to get the event details of all the indexes wise in splunk but i couldn't. please help me out on this

Thankyou.

Labels (1)
0 Karma

thambisetty
Super Champion

In this case, you should look into all the sources that will have user information.

if you are not sure of sources where and all user information would be available then you should run search index=* usernameformat1 OR usernameformatinemail OR usernameformat2

different sources will record username in different formats for example windows authentication you might see just username but email logs will have email address rather username. So you should run a search specifying all formats of username in search.

you can’t use meta search the one you shared above. That will only look at meta fields source,sourcetype, index and _time and host. That will not give info inside the event.

————————————
If this helps, give a like below.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Could you please more specific about what you are trying to do?  What information about indexes and/or events do you seek?

---
If this reply helps you, Karma would be appreciated.
0 Karma

mputtam
Path Finder

Hi

I want to see the total event count by indexers. i was using the below query but the results are varying.

 

| tstats count where index=* groupby index

0 Karma

mputtam
Path Finder

Hi,

Here is the small scenario where you can help us on the issue. 

One of our employee is going to be terminated on Monday so we Need to get a logging report of that employee. what are all applications that employee usually logging on daily basis. I would requesting you to help us on this.

Thanks.

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...