Searches

[whitecat001]

Can i get a query that will find searches that users are running in splunk

[isoutamo]

Hi

this is quite often asked question. You could find answers from community by google.

But shortly, you couldn’t find that information from splunk audit logs. Here is couple links to tell more about the reason.

• https://community.splunk.com/t5/Splunk-Search/Data-used-by-searches/m-p/687785#M234581
• https://community.splunk.com/t5/Splunk-Search/How-to-find-which-indexes-are-used/m-p/674510

r. Ismo

[gcusello]

Hi @whitecat001 ,

do you want the list of savedsearches, the list or runned searches or what else?
could you better detail your request?

Ciao.

Giuseppe

[whitecat001]

I want to know how much volume of  index is used for splunk searches 

[gcusello]

Hi @whitecat001,

sorry, it isn't so clear:

do you want the amount of data of each search or to know which indexes are used in each search or what else?

Ciao.

Giuseppe

[whitecat001]

what indexes are used the most in splunk searches 

[whitecat001]

I want to know the total volume of indexes used for splunk searches. Query on information that has to do with how much indexes are used based on splunk searches