Splunk Search

How to create a dashboard search to output these specific fields in results?

New Member

What I'm trying to do is when I give input as index=sftp USER=gradydftsftp and it gives output as:

Jan 27 10:15:01 wmcloudsftp internal-sftp[9055]: session closed for local user gradydftsftpdata.
Jan 27 09:15:03 wmcloudsftp internal-sftp[4534]: session closed for local user gradydftsftpdata

So my question is, how can I create a dashboard with a search which displays
file name, uploadby, uploadtime, download, downloadby, and download time.

Filename is something like (9055)
uploadby is gradydftsftp
uploadtime is 09:15:03

0 Karma

Path Finder

Are you asking how to create a search that extracts fields from your events, or how to display the output of the search in a dashboard? Or both?

Obviously the logging you've shown is not sufficient to distinguish between uploads and downloads.

0 Karma

Revered Legend

From the logs, how can we differentiate if its and upload or download?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!