Hi, I wonder whether someone may be able to help me please.
From the answer I found here I'm using the query below to display searches that have been performed
index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" | stats count by user search _time | sort _time | convert ctime(_time) | stats list(_time) as time list(search) as search by user
Could someone perhaps tell me please is there a way be which I can see how long the search took to run.
Many thanks and kind regards
Chris
Try this:
| rest/services/search/jobs | fields *search* *duration* *sec*s
Try this:
| rest/services/search/jobs | fields *search* *duration* *sec*s
Hi @woodcock thank you for taking the time to come back to me with this.
I've tried the code snippet you kindly provided, but unfortunately I receive the following error:
Error in 'rest' command: This command
must be the first command of a search.
So I tried to moving this to the beginning of the search but this also doesn't work.
Any ideas where I may have gone wrong please?
Many thanks and kind regards
Chris
My solution is not an extension to your original search but a 100% replacement for it. I tested it on v6.2.3 and it works just fine as-is. Use my solution's search string exactly as-is and it should give you everything you need (but in a totally different format).
Hi thank you for coming back to me with this, and my apologies for perhaps not making this clearer, but is there a way by which I can integrate the two because I'd like to include the search the user performed and the username?
Many thanks and kind regards
Chris
Get rid of everything after (and including) the |
and see what fields are there (there is a username field but I don't recall what the name is).
Hi @woodcock that's great.
Kind regards and many thanks.
Chris