- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: I need to know which index and app has been ac...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need to know which index and app has been access how many time in last one month
I need to know how many time all the indexes in my splunk has been accessed in last 30 days by app name(I tried so many posts but none of the post resolved my issue). can anyone help me to get this fixed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This may help you:
index=_audit action=search search=* sourcetype=audittrail | rex field=search "sourcetype\s*=\s*\"*(?<SourcetypeUsed>[^\s\"]+)" | rex field=search "index\s*=\s*\"*(?<IndexUsed>[^\s\"]+)" | search IndexUsed=* OR SourcetypeUsed=* | fillnull value="NA" IndexUsed SourcetypeUsed| stats count by IndexUsed SourcetypeUsed
The count represents a number of searches execution that are using that index/sourcetype.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Based on the comment thread, @p_gurav, you should convert your comment to an answer, so @csharm21 can accept it.
@csharm21 you should ask that as a separate question, in my humble opinion. Adding the APP to the query, most likely means you're querying _internal also, which would require a lot more work to add in.
If this reply helps you, an upvote would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks p_gurav, this is working. I also need to filter this by application name. would you be able to help on this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What you mean by "accessed", do you mean how many time somone searched in an index?
That information can you see in _audit.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@broberge yes i need to pull detail how many time some one searched the index. if that index has not been searched more then one month, we will do clean up. I tried multiple things using _Audit but still no luck.
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
.conf24 | Personalize your .conf experience with Learning Paths!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
