https://community.splunk.com/t5/Splunk-Dev/How-to-discover-which-user-disabled-and-enabled-the-default-demo/m-p/351988#M5606 <P>This appears to work for me, when I test it against our own ES installation:</P> <PRE><CODE>index="_internal" sourcetype="splunkd_access" uri="*identity_manager*" file="disable" OR file="enable" | table _time, uri, user </CODE></PRE> <P>It returns the username and path of what the user interacted with.</P> Wed, 20 Sep 2017 23:26:48 GMT CMSchelin 2017-09-20T23:26:48Z https://community.splunk.com/t5/Splunk-Dev/How-to-discover-which-user-disabled-and-enabled-the-default-demo/m-p/351987#M5605 <P>I want to see who has disabled and enabled the default demo lookup files under Splunk ES-&gt;Data Enrichment-&gt;Identity Management, is there any Search Query which can help me ? </P> Wed, 20 Sep 2017 14:06:44 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-discover-which-user-disabled-and-enabled-the-default-demo/m-p/351987#M5605 ishammi 2017-09-20T14:06:44Z https://community.splunk.com/t5/Splunk-Dev/How-to-discover-which-user-disabled-and-enabled-the-default-demo/m-p/351988#M5606 <P>This appears to work for me, when I test it against our own ES installation:</P> <PRE><CODE>index="_internal" sourcetype="splunkd_access" uri="*identity_manager*" file="disable" OR file="enable" | table _time, uri, user </CODE></PRE> <P>It returns the username and path of what the user interacted with.</P> Wed, 20 Sep 2017 23:26:48 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-discover-which-user-disabled-and-enabled-the-default-demo/m-p/351988#M5606 CMSchelin 2017-09-20T23:26:48Z