Monitoring Splunk

Can somebody from Splunk please explain the changes to GUI search logging

responsys_cm
Builder

Prior to the 5.x (and possibly earlier), Splunk logged user searches from the GUI in a human readable format. The event had the user name and something like search="search bla bla bla | stats count by bla...". It was easy to read and audit.

Now when I look in the _internal index for searches that I or other users have run, all the searches are URL encoded. They are way more difficult to read and audit.

Why would you guys elect to make those logging events less human readable and what is the best method to advocate for changing the logging format back to something I can read?

Thx.

C

Tags (1)
1 Solution

hexx
Splunk Employee
Splunk Employee

I'm pretty sure you are referencing $SPLUNK_HOME/var/log/splunk/searches.log, which was indeed retired in 5.0 because the same level of information (and then some) is available from audit.log and in the _audit index.

The good news is it's pretty easy to gain access to the same level of information by searching the _audit index:

index=_audit search=*

If you want to make it fancier and show more information such as the start and end time range of the search, you can use this search:

index=_audit search=*
| eval earliest_time=if(like(apiStartTime,"%ZERO_TIME%"),"epoch",apiStartTime)
| eval latest_time=if(like(apiEndTime,"%ZERO_TIME%"),"now",apiEndTime)
| table _time user earliest_time latest_time search search_id

View solution in original post

hexx
Splunk Employee
Splunk Employee

I'm pretty sure you are referencing $SPLUNK_HOME/var/log/splunk/searches.log, which was indeed retired in 5.0 because the same level of information (and then some) is available from audit.log and in the _audit index.

The good news is it's pretty easy to gain access to the same level of information by searching the _audit index:

index=_audit search=*

If you want to make it fancier and show more information such as the start and end time range of the search, you can use this search:

index=_audit search=*
| eval earliest_time=if(like(apiStartTime,"%ZERO_TIME%"),"epoch",apiStartTime)
| eval latest_time=if(like(apiEndTime,"%ZERO_TIME%"),"now",apiEndTime)
| table _time user earliest_time latest_time search search_id
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...