Splunk Search

How to determine which users and what apps are using summary events created by my searches?

krishnani
New Member

1) How to evolve the summary searches and I want to know if anyone uses the summary events created by my searches?

2) How to determine what apps are using summary events created by my searches?

3) How to determine who's using data from a particular summary search?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

I don't know what you mean by "optics summary searches", but you can get information on who runs what search from the _audit log. You'll have to refine this to meet your needs, but maybe this gets you started: index=_audit action=search search="*index=*" | table user search
This will only work, if your summary indices are not searched by default, i.e. the user has to explicitly specify the index name.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...