Splunk Search

Determining user search timeframes

a212830
Champion

Hi,

Is there anyway to determine what timeframes (24 hours, 7 days, 15 minutes...) are being used for searches in Splunk? I want to use that as criteria for data retention policy.

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can get various information about searches executed from _audit index. A sample search which provides period used in the search could be like below:

index=_audit action=search info="completed"
|eval period=search_lt-search_et
|eval ExecutionTime=strftime(exec_time,"%Y-%m-%d %H:%M")
|eval StartTime=strftime(search_et,"%Y-%m-%d %H:%M")
|eval EndTime=strftime(search_lt,"%Y-%m-%d %H:%M")
|eval searchDuration=case(period < 60,round(period)." sec",period <3600,round(period/60)." Min",period <86400,round(period/3600)." Hr",1=1,round(period/86400)." Days")
|eval suffix=" from "+StartTime
|eval searchDuration=case(ExecutionTime=EndTime,"Last "+searchDuration,1=1,searchDuration+suffix)
|table user , ExecutionTime,StartTime ,EndTime ,period,searchDuration

You can customize similar queries as per your requirement.

gkanapathy
Splunk Employee
Splunk Employee

Yes, searches and information about them are recorded in audit.log (which is by default indexed into the _internal index).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...