Splunk Search

Splunk Search Query

mailmetoramu
Explorer

Looking for an search query to monitor some bunch of users on all indexes activity. Tried the below one but couldn't get my actual requirement , let me know some more efficient queries to get this.

index=* user= apptusr user=oracleapp user=oracledb user=oracleftp |stats count by src dest user name action index

Labels (1)
0 Karma

mailmetoramu
Explorer

Thanks for the reply, i got ur baseline.  The query which i have mentioned is already working but i need some suggestions how to tweak the query.  Again pasting my query below, please give me an query which would cover my requirement.

index=* user= apptusr user=oracleapp user=oracledb user=oracleftp |stats count by src dest user name action 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I take it you want to know if certain users run queries containing "index=*".  if that is incorrect then please clarify the question.

The given query looks in all indexes for events where the 'user' field contains all four values simultaneously.  That can never happen.  Even if it could, it wouldn't satisfy the requirement because it's looking in index=* rather than for index=*.

The Splunk Admins app has a search that be useful for this.  Check out "SearchHeadLevel - Scheduled searches not specifying an index".

Another approach is to search the _internal index for "index=*" and the user names of interest.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...