Monitoring Splunk

List searches searching old events

ktn01
Path Finder

Hello

Is it a way to find how much searches are searching events older than 2 years?

I need this information to evaluate the impact if I set the "tsidx retention policy" to two years.

Thanks

Labels (2)
Tags (1)
0 Karma
1 Solution

javiergn
Super Champion

Hi @ktn01 ,

 

You could try something like this:

index=_audit TERM(action=search) TERM(info=completed)
| where search_et <= relative_time(now(), "-2y")
| table _time, user, search_et, search
| eval earliest=strftime(search_et, "%Y-%m-%dT%H:%M:%S")
| sort limit=0 search_et

 

 

Or if you want to be more precise you can use the difference between execution time and earliest time and return those greater than 2 years:

index=_audit TERM(action=search) TERM(info=completed)
| eval diffInYears = (exec_time-search_et)/(365*86400)
| where diffInYears > 2
| table _time, user, search_et, exec_time, diffInYears, search
| eval earliest=strftime(search_et, "%Y-%m-%dT%H:%M:%S")
| eval executionTime=strftime(exec_time, "%Y-%m-%dT%H:%M:%S")
| sort limit=0 search_et

Regards,

J

View solution in original post

javiergn
Super Champion

Hi @ktn01 ,

 

You could try something like this:

index=_audit TERM(action=search) TERM(info=completed)
| where search_et <= relative_time(now(), "-2y")
| table _time, user, search_et, search
| eval earliest=strftime(search_et, "%Y-%m-%dT%H:%M:%S")
| sort limit=0 search_et

 

 

Or if you want to be more precise you can use the difference between execution time and earliest time and return those greater than 2 years:

index=_audit TERM(action=search) TERM(info=completed)
| eval diffInYears = (exec_time-search_et)/(365*86400)
| where diffInYears > 2
| table _time, user, search_et, exec_time, diffInYears, search
| eval earliest=strftime(search_et, "%Y-%m-%dT%H:%M:%S")
| eval executionTime=strftime(exec_time, "%Y-%m-%dT%H:%M:%S")
| sort limit=0 search_et

Regards,

J

ktn01
Path Finder

Thanks for your help

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...