Our problem is, some people are running searches without specifying any source types and it's causing maximum system resource utilization.
I want to warn those users not to run any search without a sourcetype. Is there a way where if a user runs any search without a sourcetype, after one minute, the search gets cancelled automatically?
Any thoughts?
You should use the Distributed Management Console or the Search Activity App to see the maximum system resource utilization in searches.
In this way you could find all the worst searches in your system not only the ones without sourcetype.
Bye.
Giuseppe
if you're satisfied of the answer, please, accept the answer.
Bye.
Giuseppe
Try something like this should help you detect users and their search which are not using index/sourcetypes
index=_audit action=search search=* sourcetype=audittrail search=* search_id=* NOT (user=splunk-system-user ) | rex field=search "sourcetype\s*=\s*\"*(?<SourcetypeUsed>[^\s\"]+)" | rex field=search "index\s*=\s*\"*(?<IndexUsed>[^\s\"]+)" | where isnull(IndexUsed) OR isnull(SourcetypeUsed) | table _time user search search_id