Splunk Search

I need to know which index and app has been access how many time in last one month

csharm21
Loves-to-Learn

I need to know how many time all the indexes in my splunk has been accessed in last 30 days by app name(I tried so many posts but none of the post resolved my issue). can anyone help me to get this fixed.

Tags (1)
0 Karma

p_gurav
Champion

This may help you:

index=_audit action=search search=* sourcetype=audittrail  | rex field=search "sourcetype\s*=\s*\"*(?<SourcetypeUsed>[^\s\"]+)"  | rex field=search "index\s*=\s*\"*(?<IndexUsed>[^\s\"]+)" | search IndexUsed=* OR SourcetypeUsed=* | fillnull value="NA" IndexUsed SourcetypeUsed| stats count by IndexUsed SourcetypeUsed

The count represents a number of searches execution that are using that index/sourcetype.

efavreau
Motivator

Based on the comment thread, @p_gurav, you should convert your comment to an answer, so @csharm21 can accept it.
@csharm21 you should ask that as a separate question, in my humble opinion. Adding the APP to the query, most likely means you're querying _internal also, which would require a lot more work to add in.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

csharm21
Loves-to-Learn

Thanks p_gurav, this is working. I also need to filter this by application name. would you be able to help on this.

0 Karma

broberg
Communicator

What you mean by "accessed", do you mean how many time somone searched in an index?
That information can you see in _audit.

0 Karma

csharm21
Loves-to-Learn

@broberge yes i need to pull detail how many time some one searched the index. if that index has not been searched more then one month, we will do clean up. I tried multiple things using _Audit but still no luck.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...