Splunk Search

how to view the list of search queries run for a given time

Explorer

I work in a shared splunk environment where any one can run splunk query. I want to see all the queries run in splunk environment for any given time. one idea is to look inside the _audite of Splunk. Can anyone help me to sort it out.

Tags (2)

SplunkTrust
SplunkTrust

See the history command.

|history 

Also see this (user queries)

index=_audit action="search" search=* NOT user="splunk-system-user"

SplunkTrust
SplunkTrust

The search for audit should give the data you want. For more formatted answer, refer to @Mus answer here. http://answers.splunk.com/answers/151378/history-command-is-not-showing-the-searches-run-by-all-the-...

0 Karma

Explorer

Thanks it works, but as I said I work in a shared environment and history command dont show me the commands of other people that they have run on splunk. I can only see the commands that I have run on splunk. I have got the administration privillages on Splunk.

0 Karma