topic Which log would have the info about user creation? in Security

Which log would have the info about user creation?

anoopambli — Wed, 16 Mar 2022 21:42:35 GMT

Hi,

I have added couple of users in splunk using command line option. After few days few of them came back to me with login issue. I wanted to check in the log and find out whether those users were really added. Which log would have the info about user creation?

Re: User creation log

somesoni2 — Tue, 03 Jun 2014 15:25:15 GMT

It should be present in the _audit index.

Sample query:

index=_audit object=<newUserName>

Re: User creation log

ngohel — Wed, 16 Mar 2022 21:20:30 GMT

I have used the following query which shows the list of users created along with user details.

(index=_audit sourcetype=audittrail action=create_user )
| table _time action info username roles user fullname email
| rename user AS CreatedBy