Splunk Search Query

[mailmetoramu]

Looking for an search query to monitor some bunch of users on all indexes activity. Tried the below one but couldn't get my actual requirement , let me know some more efficient queries to get this.

index=* user= apptusr user=oracleapp user=oracledb user=oracleftp |stats count by src dest user name action index

[mailmetoramu]

Thanks for the reply, i got ur baseline.  The query which i have mentioned is already working but i need some suggestions how to tweak the query.  Again pasting my query below, please give me an query which would cover my requirement.

index=* user= apptusr user=oracleapp user=oracledb user=oracleftp |stats count by src dest user name action 

[richgalloway]

I take it you want to know if certain users run queries containing "index=*".  if that is incorrect then please clarify the question.

The given query looks in all indexes for events where the 'user' field contains all four values simultaneously.  That can never happen.  Even if it could, it wouldn't satisfy the requirement because it's looking in index=* rather than for index=*.

The Splunk Admins app has a search that be useful for this.  Check out "SearchHeadLevel - Scheduled searches not specifying an index".

Another approach is to search the _internal index for "index=*" and the user names of interest.