Splunk Search

How can we identify users who are running searches without specifying sourcetypes? They are causing skipped searches in Splunk.

krishnani
New Member

Our problem is, some people are running searches without specifying any source types and it's causing maximum system resource utilization.

I want to warn those users not to run any search without a sourcetype. Is there a way where if a user runs any search without a sourcetype, after one minute, the search gets cancelled automatically?

Any thoughts?

0 Karma

gcusello
SplunkTrust
SplunkTrust

You should use the Distributed Management Console or the Search Activity App to see the maximum system resource utilization in searches.
In this way you could find all the worst searches in your system not only the ones without sourcetype.
Bye.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

if you're satisfied of the answer, please, accept the answer.
Bye.
Giuseppe

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this should help you detect users and their search which are not using index/sourcetypes

index=_audit action=search search=* sourcetype=audittrail  search=* search_id=* NOT (user=splunk-system-user ) | rex field=search "sourcetype\s*=\s*\"*(?<SourcetypeUsed>[^\s\"]+)"  | rex field=search "index\s*=\s*\"*(?<IndexUsed>[^\s\"]+)" | where isnull(IndexUsed) OR isnull(SourcetypeUsed) | table _time user search search_id
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...