https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-Audit-Splunk-User-Activities/m-p/654716#M2448 <P>Dear Splunk Community,</P> <P>I have tried somehow to monitor user activities with Splunk. Through the documentation I found that I can analyze it through index=_audit, however, in these records there are activities that I have not carried out directly.</P> <P>For example, if I apply the query: "index=_audit user=my.user | stats count by user,action" in the last 24 hours, the result will show actions like: edit_local_apps, search, list_workload_pools, list_health, quota, edit_roles, edit_roles_grantable, etc. And of those, the only activity that I performed directly was "search".</P> <P>Perhaps you know how to discriminate from all the audited actions those that I carried out directly?</P> Thu, 17 Aug 2023 18:11:16 GMT keperez 2023-08-17T18:11:16Z https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-Audit-Splunk-User-Activities/m-p/654716#M2448 <P>Dear Splunk Community,</P> <P>I have tried somehow to monitor user activities with Splunk. Through the documentation I found that I can analyze it through index=_audit, however, in these records there are activities that I have not carried out directly.</P> <P>For example, if I apply the query: "index=_audit user=my.user | stats count by user,action" in the last 24 hours, the result will show actions like: edit_local_apps, search, list_workload_pools, list_health, quota, edit_roles, edit_roles_grantable, etc. And of those, the only activity that I performed directly was "search".</P> <P>Perhaps you know how to discriminate from all the audited actions those that I carried out directly?</P> Thu, 17 Aug 2023 18:11:16 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-Audit-Splunk-User-Activities/m-p/654716#M2448 keperez 2023-08-17T18:11:16Z