How Splunk admin can find a search executed by user which causing SearchResults - Corrupt csv header, 2 columns with the same name '__mv_Calling_Station_Identifier' (col #xx and #xxx, #xxx will be ignored)
Hi,
I am not sure I get your question, but if you ask where you can find executed searches in splunkd log. then have a look at
index=_audit action="search" search=* NOT user="splunk-system-user"
also refer to
Please accept the answer if it was helpful thank you 🙂
thanks , let me clarify my question: I do see a lot of errors in my search head internal logs as "SearchResults - Corrupt csv header, 2 columns with the same name '__mv_Calling_Station_Identifier' (col #xx and #xxx, #xxx will be ignored)" which means I have some users running ad-hoc/scheduled searches and resulting duplicate field names like ...|fields a b c a d b e ( here a and b are duplicated unnecessary)
I have hundreds of users running thousands of searches daily and its impossible to look manually each of them for above issue) I am looking a way to identify those users and their search strings.