topic Re: How to determine who delete an alert/report? in Getting Data In

How to determine who delete an alert/report?

vnguyen46 — Mon, 20 May 2019 15:38:14 GMT

Hello - I have created, saved and scheduled a report running on a daily basis. In one day, the report was deleted from Splunk. Is there a way I can find out who deleted that report and when? I guess this is also applied to the alert.

Thanks,

Re: How to determine who delete an alert/report?

koshyk — Wed, 30 Sep 2020 00:36:59 GMT

if it is done via Splunk GUI or REST, then it will be audited at :

index="_internal" method=DELETE sourcetype=splunkd_ui_access

2.If it was amended etc, you can see in index=_audit
3. if it is done via backend, hopefully you will have Operating System auditing? Like auditd or Windows Security Log?

Re: How to determine who delete an alert/report?

vnguyen46 — Mon, 20 May 2019 16:23:35 GMT

The report was deleted from Splunk web GUI. I tried both _internal and _audit indexes, but didn't gain much info about the incident.
Thanks,

Re: How to determine who delete an alert/report?

PowerPacked — Mon, 20 May 2019 17:58:11 GMT

take a look at below pic

Replace alert_123 with your alert name.

Thanks

Re: How to determine who delete an alert/report?

Vijeta — Mon, 20 May 2019 18:15:01 GMT

If its a saved search /report you can try this, the user field will give you who deleted the report.

index=_internal method=DELETE sourcetype=splunkd* source="/opt/splunk/var/log/splunk/splunkd_ui_access.log" uri=*saved/searches*

Re: How to determine who delete an alert/report?

vnguyen46 — Mon, 20 May 2019 19:19:46 GMT

I tried all the suggestions, but still not seeing the records of when the report was deleted and by whom. The report was deleted after 8:00AM 05/15/19 and before 8:00AM 05/16/19.
I already opened a case with Splunk with diag file. Hope they find something.
Thanks,