How to search a specific user's internet activity for a certain time range? (websites visited, search history, timestamps)

[RobertKepner]

I am trying to complete a request for a specific employees internet search history. I need to specify a date range, list all websites visited, and the time the searches occurred. I can't seem to get the search string right, any help would be appreciated.

[Jarohnimo]

If it's IIS just grab the ur_stem="*" and whatever is the parsed field for username and then table the results by those same fields ... also include _time

[Richfez]

A quick look at the fortigate log documentation says this probably is possible, but so much depends on exactly how you have the device(s) configured, if you have the Splunk Fortigate App installed and so on.

If you could please describe and provide a few examples of what logs you have available and perhaps what search you have that isn't working, we could potentially help you with this.

[woodcock]

Show a sample log and maybe we can get on with helping.

[saurabh_tek]

Hello @RobertKepner - did you manage to get this done ?

@sundareshr @woodcock
I wanted to check - if fortigate logs would be enough to get this done or something else would also be needed ?
I am also planning to achieve the same. i think if i shall make a search query out of fortigate data, i should be able to achieve this..

[woodcock]

I am not familiar what those logs so I cannot say.

[sundareshr]

@saurabh_tek I am not familiar with the fortigate data either. If you can share a couple of events with extracted field names, we can help.

[sundareshr]

It would help some of the raw data and/or your current search.