Splunk queries for artifact attachments, add or download
search cancel

Splunk queries for artifact attachments, add or download


Article ID: 92664


Updated On:


CA Agile Central On Premise (Rally) CA Agile Central SaaS (Rally)


How can one query Splunk to see who uploaded or downloaded an attachment?


Component: ACSAAS


The following can be used to determine who downloaded an attachment, when and the attachment name note that the subID and project OOID can be added to the query to limit the results.  Also limiting the time frame through Splunk presets is recommended as well;

Downloaded attachments
attachment | spath subscriptionId | search subscriptionId=<ADD subID HERE> | spath projectOid | search projectOid=<ADD project OOID HERE>| spath "javaRequestSpan.httpMethod" | search "javaRequestSpan.httpMethod"=GET | table userId,_time,javaRequestSpan.uri

The following is for uploaded attachments (add subID and project OOID as needed) 

Upload attachments
Attachments/add | spath subscriptionId | search subscriptionId=<ADD subID HERE> | spath "javaRequestSpan.httpMethod" | search "javaRequestSpan.httpMethod"=POST | spath projectOid | search projectOid=<ADD project OOID HERE> | table userId,  _time,javaRequestSpan.uri

Export a csv file of the results by clicking on the down arrow to the right;

<Please see attached file for image>

splunk screen shot



1558703697716000092664_sktwi1f5rjvs16ldc.png get_app