Splunk Search

Splunk Search Query

mailmetoramu
Explorer

Looking for an search query to monitor some bunch of users on all indexes activity. Tried the below one but couldn't get my actual requirement , let me know some more efficient queries to get this.

index=* user= apptusr user=oracleapp user=oracledb user=oracleftp |stats count by src dest user name action index

Labels (1)
0 Karma

mailmetoramu
Explorer

Thanks for the reply, i got ur baseline.  The query which i have mentioned is already working but i need some suggestions how to tweak the query.  Again pasting my query below, please give me an query which would cover my requirement.

index=* user= apptusr user=oracleapp user=oracledb user=oracleftp |stats count by src dest user name action 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I take it you want to know if certain users run queries containing "index=*".  if that is incorrect then please clarify the question.

The given query looks in all indexes for events where the 'user' field contains all four values simultaneously.  That can never happen.  Even if it could, it wouldn't satisfy the requirement because it's looking in index=* rather than for index=*.

The Splunk Admins app has a search that be useful for this.  Check out "SearchHeadLevel - Scheduled searches not specifying an index".

Another approach is to search the _internal index for "index=*" and the user names of interest.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...