Splunk Search

_audit - see users behavior - users searches by sourcetypes

egreibl
Engager

Hi guys,
hope you can help me.
I want to have a statistic of my users. The most of the users access the search&reporting app and not a specific app. So, I want to have a report about the sourcetypes they are looking for. Example:
user XY searched sourcetype ZZ 4 times per day

thanks for your help.
Cheers, Lisi

0 Karma
1 Solution

inventsekar
Super Champion

this gives the Sourcetypes and indexes and usernames.

index=_audit action=search search=* sourcetype=audittrail  search=* search_id=* NOT (user=splunk-system-user ) | rex field=search "sourcetype\s*=\s*\"*(?<SourcetypeUsed>[^\s\"]+)"  | rex field=search "index\s*=\s*\"*(?<IndexUsed>[^\s\"]+)" | table _time user search SourcetypeUsed IndexUsed
PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.

View solution in original post

0 Karma

David
Splunk Employee
Splunk Employee

Unfortunately reporting on implicit sourcetypes or indexes is not possible, unless there is new auditing added in 6.5. The answer given by inventsekar is as close as you will come.

0 Karma

inventsekar
Super Champion

this gives the Sourcetypes and indexes and usernames.

index=_audit action=search search=* sourcetype=audittrail  search=* search_id=* NOT (user=splunk-system-user ) | rex field=search "sourcetype\s*=\s*\"*(?<SourcetypeUsed>[^\s\"]+)"  | rex field=search "index\s*=\s*\"*(?<IndexUsed>[^\s\"]+)" | table _time user search SourcetypeUsed IndexUsed
PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

egreibl
Engager

Hi,

thanks for your answer.
But what I am looking also for users who only search e.g. "ip X.X.X." so, they do not enter explicit the sourcetype. Maybe it is possible to search by the roles? because then I can identify between the different accessrights and therefore which sources where searched how often.

to search for the field "role" it's not possible. do you know the field for "Roles"?
thanks

0 Karma

inventsekar
Super Champion

"role" is not available.
---- But what I am looking also for users who only search e.g. "ip X.X.X." so, they do not enter explicit the sourcetype ----
are you looking for users who search without explicit sourcetype?

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...