In Splunk v7 we used to search index=_internal to find events that contained GET AND "/results/export?output" This provided us with information about who had performed the export, in which App, how long the download took, bytes downloaded and which fields had been download, etc In Splunk 9 we have had to switch to searching index=_internal for POST and "/results/export". From reading it looks like GET has been deprecated, not that the HTTP method really matters to us. However the appended list of fields that were downloaded with the export activity no longer appears to be generated. For us this is an unfortunate regression as it limits our visibility to quickly assess what has been downloaded without needing to re-generate the search. It would be useful to understand why the downloaded field set is no longer part of the export event. And whether there is something we can potentially configure to enable this to be visible in the events again. On an aside we feel that these events would be better located in the index=_audit as the index=_internal rolls pretty quickly, so if not constantly forwarding elsewhere visibility of such export activity is transient (noting that there is also an export event generated in _audit but we find that log event of less utility in compliance checks).
... View more
