Splunk Search

how do i get a list of all searches performed in splunk?

ytl
Path Finder

can someone help me with a query to provide me a table of _time, user, search string of all queries performed in splunk please?

Tags (2)
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi ytl,

you need to have read access to index=_audit and run something like this:

index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" | stats count by user search _time | sort _time | convert ctime(_time) | stats list(_time) as time list(search) as search by user

if this does not match your needs, adapt this search.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi ytl,

you need to have read access to index=_audit and run something like this:

index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" | stats count by user search _time | sort _time | convert ctime(_time) | stats list(_time) as time list(search) as search by user

if this does not match your needs, adapt this search.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

as addition:

If you're on Splunk 6.x you can open this URL and get the same:

http[s]://YourSplunkServerName:YourSplunkWebPort/app/search/status_index

nawazns5038
Builder

how to exclude the searches obtained from a dashboard ?

0 Karma

niketnilay
Legend

@nawazns5038, if your intent is to find only the searches which are run through Splunk UI, you can try the following:

index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=sourcetypes | search totalCount > 0"
| stats count by _time user search savedsearch_name  
| where savedsearch_name=""
| fields - savedsearch_name

PS: savedsearch_name will be given to saved searches and dashboard searches not for the searches run via UI.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!