Monitoring Splunk

List searches searching old events

ktn01
Path Finder

Hello

Is it a way to find how much searches are searching events older than 2 years?

I need this information to evaluate the impact if I set the "tsidx retention policy" to two years.

Thanks

Labels (2)
Tags (1)
0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Hi @ktn01 ,

 

You could try something like this:

index=_audit TERM(action=search) TERM(info=completed)
| where search_et <= relative_time(now(), "-2y")
| table _time, user, search_et, search
| eval earliest=strftime(search_et, "%Y-%m-%dT%H:%M:%S")
| sort limit=0 search_et

 

 

Or if you want to be more precise you can use the difference between execution time and earliest time and return those greater than 2 years:

index=_audit TERM(action=search) TERM(info=completed)
| eval diffInYears = (exec_time-search_et)/(365*86400)
| where diffInYears > 2
| table _time, user, search_et, exec_time, diffInYears, search
| eval earliest=strftime(search_et, "%Y-%m-%dT%H:%M:%S")
| eval executionTime=strftime(exec_time, "%Y-%m-%dT%H:%M:%S")
| sort limit=0 search_et

Regards,

J

View solution in original post

javiergn
SplunkTrust
SplunkTrust

Hi @ktn01 ,

 

You could try something like this:

index=_audit TERM(action=search) TERM(info=completed)
| where search_et <= relative_time(now(), "-2y")
| table _time, user, search_et, search
| eval earliest=strftime(search_et, "%Y-%m-%dT%H:%M:%S")
| sort limit=0 search_et

 

 

Or if you want to be more precise you can use the difference between execution time and earliest time and return those greater than 2 years:

index=_audit TERM(action=search) TERM(info=completed)
| eval diffInYears = (exec_time-search_et)/(365*86400)
| where diffInYears > 2
| table _time, user, search_et, exec_time, diffInYears, search
| eval earliest=strftime(search_et, "%Y-%m-%dT%H:%M:%S")
| eval executionTime=strftime(exec_time, "%Y-%m-%dT%H:%M:%S")
| sort limit=0 search_et

Regards,

J

View solution in original post

ktn01
Path Finder

Thanks for your help

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!