Splunk Search

Report all real-time searches from the internal audit index

landen99
Motivator

Enable alerts and reports on real-time searches seen in the internal audit index.

Labels (1)
0 Karma

landen99
Motivator

The following search presents the real-time searches from the audit index:

index=_audit action=search info=granted search=* NOT ("search_id='scheduler" OR "search='|history" OR "user=splunk-system-user" OR "search='typeahead" OR "search='| metadata type=* | search totalCount>0" OR "| metadata type=sourcetypes | search totalCount > 0" ) "search_id='rt_*"
| table _time user host info savedsearch_name search search_id
0 Karma

gjanders
SplunkTrust
SplunkTrust

Nice. In alerts for splunk admins https://splunkbase.splunk.com/app/3796/

I have a few searches to look for bad practices or all time searches in dashboards or similar...FYI

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!