Hi, I have a requirement to alert all users who have pressed "export" from Splunk. I have written the spl for listing users who have exported search results or dashboard panels.     index=_internal export | regex uri_path="(jobs|results|events)\/export$" | table user | dedup user     But this is not catching the dashboard exports. I want to alert users who have exported the complete dashboard in pdf format. Kind help will be appreciated. ... View more

Can anyone help me with the resources to prepare for Admin Certification Exam? Or if someone can share how he/she prepared without taking the Splunk Recommended Courses. The recommended - Data and System Administration courses are way too costly for me. ... View more