Splunk Search

In a search head cluster, how do I search users that have logged in the last 30 minutes, on what cluster member, and what kind of searches they are running?

Path Finder

What setup is required and what will be the search so that I can find out,

  1. Who all have logged in to the system in the last 30 minutes
  2. what kind of searches they are running
  3. which search head (I've three in my cluster) these users were connected/logged in to

thanks, ronak

0 Karma

Path Finder

splunk_webaccess -> splunk_ui_access

logged in users
index=_internal sourcetype=splunkd_ui_access | dedup host user | table host user _time req_time
logged in users rolling time

index=_internal sourcetype=splunkd_ui_access | table host user _time req_time

Builder

If you have an indexer cluster -> You should have all this info in the Distributed Management Console on the Cluster Master.

0 Karma

Path Finder

where it that in DMC?

0 Karma

Influencer

Start here

For users logged in, and search head they are in


index=_internal sourcetype=splunk_webaccess | dedup host USER | table host USER

For the searches issued..


index=_internal sourcetype=splunkd_remote_searches

Cross check the sourcetypes for the exact naming..

0 Karma

Explorer

sourcetype of splunk_webaccess at least in 6.3.3 version isn't available..

0 Karma

Path Finder

verified 6.5.3
index=_internal sourcetype=splunkd_ui_access | dedup host user | table host user _time req_time

0 Karma