Splunk Searches | A collection of useful Splunk SPL

Splunk Search for Indexes Created by Users Copy


				index=_internal sourcetype=splunk_python action="handleCreate"
| stats latest(_time) as _time by loginUsername indexName

0 comments

[0]

Splunk Search for Fields in CIM Datamodel Copy


				| rest splunk_server=local /servicesNS/-/Splunk_SA_CIM/data/models | fields title eai:data | spath input=eai:data path=objects{}.fields{} output=fields | mvexpand fields | spath input=fields | fields - eai:data fields

0 comments

[0]

Splunk Search for Deployment Server Serverclasses Copy


				| rest splunk_server=local /services/deployment/server/serverclasses | table title whitelist* blacklist*

0 comments

[0]

Splunk Search for Deployment Clients that Havent Phoned Home in 24 Hours Copy


				| rest splunk_server=local /services/deployment/server/clients | eval now=now(), diffTime=now-lastPhoneHomeTime, lastPhoneHomeTime=strftime(lastPhoneHomeTime,"%b %d, %Y %H:%M:%S") | search diffTime>86400 | table hostname ip instanceName utsname package splunkVersion lastPhoneHomeTime

0 comments

[0]

Splunk Search for Information About Deployment Clients Copy


				| rest splunk_server=local /services/deployment/server/clients | table hostname ip instanceName utsname package splunkVersion

0 comments

[0]

Splunk Search for Apps Installed in the Environment Copy


				| rest /services/apps/local | search disabled IN ("false",0)| table title version description splunk_server

0 comments

[0]

Splunk Search for Duplicate Events in Splunk Copy


				index=*  | stats count by _raw, index, sourcetype, source, host | where count>1

0 comments

[1]

[0]

Splunk Search for Duplicate Events by Index, Sourcetype Copy


				index=* | stats count by _raw, index, sourcetype | where count>1 | stats values(sourcetype) as sourcetype by index

0 comments

[1]

[0]

Splunk Search for Apps and Views that Users are Accessing Copy


				index=_internal earliest=@d latest=now | stats latest(_time) as _time, values(view) as view, values(app) as app, values(uri) as uri by user

0 comments

[1]

[0]

Splunk Search for Recently Active Users Copy


				index=_internal earliest=-5m latest=now sourcetype=splunk_web_access user!="internal_monitoring" user!="-" | stats count by user | fields - count

0 comments

[0]