Splunk Search

Which user is running search ?

maitrifer
Engager

Hi All, I have a requirement I wanted to check which user is running a search. I need help in SPL query to get user and search details.

Labels (2)
0 Karma
1 Solution

vikramyadav
Contributor

index=_audit action=search sourcetype=audittrail search_id=* NOT (user=splunk-system-user) search!="'typeahead*"
| rex "search\=\'(search|\s+)\s(?P<search>[\n\S\s]+?(?=\'))"
| rex field=search "sourcetype\s*=\s*\"*(?<SourcetypeUsed>[^\s\"]+)"
| rex field=search "index\s*=\s*\"*(?<IndexUsed>[^\s\"]+)"
| stats latest(_time) as Latest by user search SourcetypeUsed IndexUsed
| convert ctime(Latest)

--------------------------------------------------------

If this helps your like will be appreciated😊

View solution in original post

vikramyadav
Contributor

index=_audit action=search sourcetype=audittrail search_id=* NOT (user=splunk-system-user) search!="'typeahead*"
| rex "search\=\'(search|\s+)\s(?P<search>[\n\S\s]+?(?=\'))"
| rex field=search "sourcetype\s*=\s*\"*(?<SourcetypeUsed>[^\s\"]+)"
| rex field=search "index\s*=\s*\"*(?<IndexUsed>[^\s\"]+)"
| stats latest(_time) as Latest by user search SourcetypeUsed IndexUsed
| convert ctime(Latest)

--------------------------------------------------------

If this helps your like will be appreciated😊

View solution in original post

thambisetty
Super Champion
index=_audit action=search | stats earliest(user) as user ,earliest(search) as search by search_id
————————————
If this helps, give a like below.
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!