Splunk Search

search help


Hi Guys,


We can see there are 6 hosts which are sending bulk events (logs) to splunk. But we don’t know who is using these host events in spunk. Is there any way we can identify the searches, reports, alerts or dashboards where these hosts events are being used. The purpose is if no where these logs are being used then we can stop the forwarders from those hosts.

Labels (1)
0 Karma


please try this 

index=_* sourcetype=audittrail action=search host=host1 OR host=host2 OR host=host3 OR host=host4 OR host=host5 OR host=host6 | stats count BY user host | sort 0 - count | stats list(*) AS * BY user

Tags (1)
0 Karma


Hi @roopeshetty 

can you explain better your use-case?

you received logs from 6 hosts, right?

can  you indentify the hosts with the hosts field?

for each host is configured a uf?



“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...