Security

How can I get the details about the queries run by user

pradeepkumarg
Influencer

I want to know the details of the queries issued by users.

index=_internal sourcetype="searches"

This only gives me the search query and not earliest,latest,run_time. Is there a way to get these details?

Tags (3)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You can try following query.

index=_audit action=search info=completed

This will give you fields like user, total run time,result count, time when search was executed, search time range and variety of other information.

Cheers.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

You can try following query.

index=_audit action=search info=completed

This will give you fields like user, total run time,result count, time when search was executed, search time range and variety of other information.

Cheers.

gfuente
Motivator

Hello

In the default search app, you have a few reports with search user activity, you can found them in:

Status\Search Activity\

In particular: Search Activity per user.

In addition to those reports, you have even more in the SOS app that you can download from apps.splunk.com

Regards

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...