Splunk Search

List of users who searched data of an index

svelagala
Loves-to-Learn

How to get users(SAML authenticated) list who searched for data under particular index(_internal) in the last 24hrs.

Tags (1)
0 Karma

to4kawa
Ultra Champion
| tstats count where index=_audit TERM("_internal") by PREFIX("user=")

svelagala
Loves-to-Learn

I have used the query you have provided but it is not giving any results.
| tstats count where index=_audit TERM("_internal") by PREFIX("user=")

Also tried like this, but no use.
| tstats count where index=_audit by user

0 Karma

to4kawa
Ultra Champion

PREFIX() can work on splunk ver 8.
user is extracted at search time. so, you are not able to use with tstats
If your splunk version is ver 7.X:

index=_audit TERM("_internal") | stats count by user

It's faster when PREFIX can be used.

0 Karma

svelagala
Loves-to-Learn

Yes, it is 7.X for us.
index=_audit TERM("_internal") | stats count by user - this works good, but I would like to know the list of users based on index names.
For Example:
I would like to know the users who searched for all the index names ending with "_archive" like _internal_archive. if I run the below it is also giving wherever "_archive" is used, instead of not only in index names.
index=_audit TERM("*_archive") | stats count by user

Can you help me on this @to4kawa

0 Karma

to4kawa
Ultra Champion
index=_audit TERM("_internal") 
| stats count values(search) as search by user
| mvexpand search
| rex field=search "index=(?\S+)"
| eval index=trim(index,"\"")
| stats values(user) by index
0 Karma

svelagala
Loves-to-Learn

index=_audit TERM("_internal")
| stats count values(search) as search by user
| mvexpand search
| rex field=search "index=(?\S+)"
| eval index=trim(index,"\"")
| stats values(user) by index

Above query almost worked but it is giving only results related to _internal index. Actually, I am looking for indexes ending with "_archive". Hence I tried in the below way.

index=_audit
| stats count values(search) as search by user
| mvexpand search
| rex field=search "index=(?\S+)"
| eval index=trim(index,"\"")
| stats values(user) by index
|search index=*_archive

let me know in case any optimization/better query can be provided @to4kawa

0 Karma

to4kawa
Ultra Champion

It is not profitable.

0 Karma

svelagala
Loves-to-Learn

Then what could be suitable query for my requirement @to4kawa

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...