Splunk query to get user, saved search name, last time the query ran

0
votes

From Splunk, I am trying to get the user, saved search name and last time a query ran ? A single Splunk query will be nice. I am very new to Splunk and I have tried these queries :-

index=_audit action=search info=granted  search=* 
| search IsNotNull(savedsearch_name)  user!="splunk-system-user"   
| table  user savedserach_name user search _time

The above query , is always empty for savesearch_name.

1
splunksplunk-query

1 Answers

1
votes

Splunk's audit log leaves a bit to be desired. For better results, search the internal index.

index=_internal savedsearch_name=* NOT user="splunk-system-user" 
| table user savedsearch_name _time

You won't see the search query, however. For that, use REST.

| rest /services/saved/searches | fields title search

Combine them something like this (there may be other ways)

index=_internal savedsearch_name=* NOT user="splunk-system-user" 
| fields user savedsearch_name _time
| join savedsearch_name [| rest /services/saved/searches 
  | fields title search | rename title as savedsearch_name]
| table user savedsearch_name search _time