Splunk Searches | A collection of useful Splunk SPL

Splunk Search for Queued Searches Copy


				index=_internal sourcetype=splunkd group=search_concurrency name=search_queue_metrics | timechart avg(current_queue_size)

0 comments

[0]

Splunk Search for Users Running All Time Searches Copy


				index=_audit action=search info=completed search_et="N/A" search_lt="N/A" user!=splunk-system-user | stats count by user

0 comments

[0]

Splunk Search for Details on Ad-hoc Searches Run by Users Copy


				index=_audit action=search search=* user!=splunk-system-user provenance!=scheduler | table _time user search host total_run_time result_count | sort - _time

0 comments

[0]