Splunk Search

How can we identify users who are running searches without specifying sourcetypes? They are causing skipped searches in Splunk.

krishnani
New Member

Our problem is, some people are running searches without specifying any source types and it's causing maximum system resource utilization.

I want to warn those users not to run any search without a sourcetype. Is there a way where if a user runs any search without a sourcetype, after one minute, the search gets cancelled automatically?

Any thoughts?

0 Karma

gcusello
SplunkTrust
SplunkTrust

You should use the Distributed Management Console or the Search Activity App to see the maximum system resource utilization in searches.
In this way you could find all the worst searches in your system not only the ones without sourcetype.
Bye.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

if you're satisfied of the answer, please, accept the answer.
Bye.
Giuseppe

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this should help you detect users and their search which are not using index/sourcetypes

index=_audit action=search search=* sourcetype=audittrail  search=* search_id=* NOT (user=splunk-system-user ) | rex field=search "sourcetype\s*=\s*\"*(?<SourcetypeUsed>[^\s\"]+)"  | rex field=search "index\s*=\s*\"*(?<IndexUsed>[^\s\"]+)" | where isnull(IndexUsed) OR isnull(SourcetypeUsed) | table _time user search search_id
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...