how do i get a list of all searches performed in splunk?

[ytl]

can someone help me with a query to provide me a table of _time, user, search string of all queries performed in splunk please?

[MuS · Accepted solution]

Hi ytl,

you need to have read access to index=_audit and run something like this:

index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" | stats count by user search _time | sort _time | convert ctime(_time) | stats list(_time) as time list(search) as search by user

if this does not match your needs, adapt this search.

Hope this helps ...

cheers, MuS

[MuS]

as addition:

If you're on Splunk 6.x you can open this URL and get the same:

http[s]://YourSplunkServerName:YourSplunkWebPort/app/search/status_index

[nawazns5038]

how to exclude the searches obtained from a dashboard ?

[niketn]

@nawazns5038, if your intent is to find only the searches which are run through Splunk UI, you can try the following:

index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=sourcetypes | search totalCount > 0"
| stats count by _time user search savedsearch_name  
| where savedsearch_name=""
| fields - savedsearch_name

PS: savedsearch_name will be given to saved searches and dashboard searches not for the searches run via UI.