Splunk Search

How to create a dashboard search to output these specific fields in results?

sujith0311
New Member

What I'm trying to do is when I give input as index=sftp USER=gradydftsftp and it gives output as:

Jan 27 10:15:01 wmcloudsftp internal-sftp[9055]: session closed for local user gradydftsftpdata.
Jan 27 09:15:03 wmcloudsftp internal-sftp[4534]: session closed for local user gradydftsftpdata

So my question is, how can I create a dashboard with a search which displays
file name, uploadby, uploadtime, download, downloadby, and download time.

Filename is something like (9055)
uploadby is gradydftsftp
uploadtime is 09:15:03

0 Karma

GregZillgitt
Path Finder

Are you asking how to create a search that extracts fields from your events, or how to display the output of the search in a dashboard? Or both?

Obviously the logging you've shown is not sufficient to distinguish between uploads and downloads.

0 Karma

somesoni2
Revered Legend

From the logs, how can we differentiate if its and upload or download?

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...