Splunk Search

Splunk Search Query

mailmetoramu
Explorer

Looking for an search query to monitor some bunch of users on all indexes activity. Tried the below one but couldn't get my actual requirement , let me know some more efficient queries to get this.

index=* user= apptusr user=oracleapp user=oracledb user=oracleftp |stats count by src dest user name action index

Labels (1)
0 Karma

mailmetoramu
Explorer

Thanks for the reply, i got ur baseline.  The query which i have mentioned is already working but i need some suggestions how to tweak the query.  Again pasting my query below, please give me an query which would cover my requirement.

index=* user= apptusr user=oracleapp user=oracledb user=oracleftp |stats count by src dest user name action 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I take it you want to know if certain users run queries containing "index=*".  if that is incorrect then please clarify the question.

The given query looks in all indexes for events where the 'user' field contains all four values simultaneously.  That can never happen.  Even if it could, it wouldn't satisfy the requirement because it's looking in index=* rather than for index=*.

The Splunk Admins app has a search that be useful for this.  Check out "SearchHeadLevel - Scheduled searches not specifying an index".

Another approach is to search the _internal index for "index=*" and the user names of interest.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...