Navigation :
Kubernetes GCP Detect Most Active Service Accounts By Pod
Description
This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision
Help |
---|
Kubernetes GCP Detect Most Active Service Accounts By Pod HelpYou must install splunk GCP add on. This search works with pubsub messaging service logs |
Search |
---|
`google_gcp_pubsub_message` data.protoPayload.request.spec.group{}=system:serviceaccounts | table src_ip src_user http_user_agent data.protoPayload.request.spec.nonResourceAttributes.verb data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource | top src_ip src_user http_user_agent data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource |`kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter` Open in Search |