Monitoring Splunk

Can somebody from Splunk please explain the changes to GUI search logging

responsys_cm
Builder

Prior to the 5.x (and possibly earlier), Splunk logged user searches from the GUI in a human readable format. The event had the user name and something like search="search bla bla bla | stats count by bla...". It was easy to read and audit.

Now when I look in the _internal index for searches that I or other users have run, all the searches are URL encoded. They are way more difficult to read and audit.

Why would you guys elect to make those logging events less human readable and what is the best method to advocate for changing the logging format back to something I can read?

Thx.

C

Tags (1)
1 Solution

hexx
Splunk Employee
Splunk Employee

I'm pretty sure you are referencing $SPLUNK_HOME/var/log/splunk/searches.log, which was indeed retired in 5.0 because the same level of information (and then some) is available from audit.log and in the _audit index.

The good news is it's pretty easy to gain access to the same level of information by searching the _audit index:

index=_audit search=*

If you want to make it fancier and show more information such as the start and end time range of the search, you can use this search:

index=_audit search=*
| eval earliest_time=if(like(apiStartTime,"%ZERO_TIME%"),"epoch",apiStartTime)
| eval latest_time=if(like(apiEndTime,"%ZERO_TIME%"),"now",apiEndTime)
| table _time user earliest_time latest_time search search_id

View solution in original post

hexx
Splunk Employee
Splunk Employee

I'm pretty sure you are referencing $SPLUNK_HOME/var/log/splunk/searches.log, which was indeed retired in 5.0 because the same level of information (and then some) is available from audit.log and in the _audit index.

The good news is it's pretty easy to gain access to the same level of information by searching the _audit index:

index=_audit search=*

If you want to make it fancier and show more information such as the start and end time range of the search, you can use this search:

index=_audit search=*
| eval earliest_time=if(like(apiStartTime,"%ZERO_TIME%"),"epoch",apiStartTime)
| eval latest_time=if(like(apiEndTime,"%ZERO_TIME%"),"now",apiEndTime)
| table _time user earliest_time latest_time search search_id
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...