About splunkfriend123

richgalloway · ‎06-28-2022

As I wrote earlier, there is no REST command to fetch ad-hoc searches. You can, however, use REST to submit a new search job (using the query provided earlier) to extract ad-hoc search info from the logs.

marysan · ‎06-26-2022

you need eai:data field too : | rest /servicesNS/-/-/data/ui/views | rename eai:acl.app AS app | rename eai:acl.perms.write as dashboard-write-permission | rename eai:acl.perms.read as dashboard-read-permission | rename eai:appName as appName | rename eai:data AS data | join type=outer appName [| rest /servicesNS/-/-/apps/local | rename title AS appName | rename eai:acl.perms.read AS app-read-permission | rename eai:acl.perms.write AS app-write-permission] | table app label title dashboard-read-permission dashboard-read-permission app-write-permission app-read-permission data

PickleRick · ‎06-25-2022

It's a question that pops up quite frequently (auditing index accesses). Might be worth creating an idea on https://ideas.splunk.com/ or supporting existing one if someone already made one.

richgalloway · ‎06-10-2022

It might be possible, but it will be a challenge. Searching index=_audit action=search will return searches executed over time along with the user who ran them. However, the search string may not include an index name. Some searches use default indexes and in others the index name may be embedded in a macro or otherwise obfuscated.

isoutamo · ‎06-08-2022

Hi I afraid that currently there is no way to find answer to this question. There is no audit log which told if bucket has accessed (read event from it and returned it to search). We have asked this couple of years ago from Splunk Support, and then they put this feature on "future development list". Maybe it's time to create official request to https://ideas.splunk.com to get it? Currently you can find those queries which contains index name on SPL, but not other queries. Or at least I don' t know how it's possible. r. Ismo

Posts	9
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎06-08-2022

Online Status	Offline
Date Last Visited	‎06-29-2022 12:07 AM

How do I write a Rest Query to fetch all unsaved s...

Rest Query to find out query along with no of exec...

Splunk Rest Query to see the definitions of all da...

How to find all manual searches performed on a sin...

Is there a way to Retrieve last 1000 searches perf...

Re: Rest Query to fetch all unsaved searches along...

Re: Splunk Rest Query to see the definitions of al...

Re: Rest Query to find out query along with no of ...

Re: Is there a way to Retrieve last 1000 searches ...

Re: How to find all manual searches performed on a...

Are you a member of the Splunk Community?