Splunk Search

identify which user is doing longest searches

amirarsalan
Explorer

Hi Everyone!

I need some help to identify which user are running longest/bad searches. Sometimes splunk goes very slow and it indicate that someone running searches/jobs that is not god and I want to identify who it is and see the search string for that user.

Someone that can help me with a query

Tags (1)
0 Karma

asneed_eu
Path Finder

The _audit index should have this information.

This would show a list of searches sorted by execution time by user:

index=_audit action="search" search=* NOT user="splunk-system-user" exec_time=* | table search total_run_time user | sort - total_run_time

You could also look at which users have the longest running searches on average:

index=_audit action="search" search=* NOT user="splunk-system-user" exec_time=* | stats avg(total_run_time) by user

amirarsalan
Explorer

Hi @asneed_eu

Thanks for your replay. It seems to works but i can only see my username. Can't see other users.

0 Karma

amirarsalan
Explorer

Beside that I can't see the total_run_time and on the search field it's only "*"

0 Karma

adonio
Ultra Champion

its out of the box with the MC (DMC)
search -> activity -> Search Usage Statistics: Deployment

0 Karma

amirarsalan
Explorer

Hi @adonio

Is this in splunk-master? If it is then i can only see users that have access to splunk-master, and that is only 3 persons.

0 Karma

adonio
Ultra Champion
0 Karma

amirarsalan
Explorer

I can only see "Add Data" there is no Splunk Monitoring Console. I can only found it in master.
And i'm a admin user

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...