Splunk Search

How to determine which users and what apps are using summary events created by my searches?

krishnani
New Member

1) How to evolve the summary searches and I want to know if anyone uses the summary events created by my searches?

2) How to determine what apps are using summary events created by my searches?

3) How to determine who's using data from a particular summary search?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

I don't know what you mean by "optics summary searches", but you can get information on who runs what search from the _audit log. You'll have to refine this to meet your needs, but maybe this gets you started: index=_audit action=search search="*index=*" | table user search
This will only work, if your summary indices are not searched by default, i.e. the user has to explicitly specify the index name.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...