Splunk Search

Report all real-time searches from the internal audit index

landen99
Motivator

Enable alerts and reports on real-time searches seen in the internal audit index.

Labels (1)
0 Karma

landen99
Motivator

The following search presents the real-time searches from the audit index:

index=_audit action=search info=granted search=* NOT ("search_id='scheduler" OR "search='|history" OR "user=splunk-system-user" OR "search='typeahead" OR "search='| metadata type=* | search totalCount>0" OR "| metadata type=sourcetypes | search totalCount > 0" ) "search_id='rt_*"
| table _time user host info savedsearch_name search search_id
0 Karma

gjanders
SplunkTrust
SplunkTrust

Nice. In alerts for splunk admins https://splunkbase.splunk.com/app/3796/

I have a few searches to look for bad practices or all time searches in dashboards or similar...FYI

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.