See what time range users search

[dtow1]

I want to write a query to see what time range users are using in their searches. e.g. 90% of searches use the last 24 hours and 10% of searches use 1+ day ago for the time frame.

I am using the following search:

index="_audit" action=search | eval searchExecutedTime = strptime(timestamp,"%m/%d/%Y") | eval searchTimeFrameStart = strptime(apiStartTime,"%m/%d/%Y") | eval past = searchExecutedTime - searchTimeFrameStart | table past

When I run this search it just opens to the statistics tab with an empty table but the tab shows that there are 2000+ results.

[xpac · Accepted solution]

I just checked my audit log, and at least from what I see your timestamp format are completely off. timestamp and apiStartTime are in completely different formats, returning both fields as empty, resulting in past being empty, and therefore getting an empty table with 2000+ lines, because in all events the past field does not exist.

If you fix your timestamp parsings, everything should be fine 🙂

Check the strftime.org documentation for an overview.

[dtow1]

Thank you very much. I think you found my problem (user error). I have been able to correct the timestamp extraction and that one is working great now. I am still unable to get results with the apiStartTime part though. Do you see anything wrong with it?

Here is what I am trying to match and what I used:

Sat Mar 31 00:00:00 2018
“%a %b %d %H:%M:%S %Y”

[dtow1]

It needed single quotes included. "'%a...%Y'"

[xpac]

Ah, damn, I saw that, but forget to post it here. Sorry!

[dtow1]

No worries, that was the info I needed and it got me straightened out. I appreciate it!

[somesoni2]

Give this a try

index="_audit" action=search search_id=* api_et=* api_lt=* | eval Past=tostring(round(api_lt-api_et),"duration") | stats count by Past

[dtow1]

Thank you that was helpful.