https://community.splunk.com/t5/Installation/Monitor-new-Splunk-admin-creation/m-p/621955#M12118 <P>Is there a way to monitor the creation of new Splunk users/admins?&nbsp;</P><P>I want to be notified if someone creates a new Splunk admin.&nbsp;</P> Thu, 24 Nov 2022 07:43:56 GMT anel 2022-11-24T07:43:56Z https://community.splunk.com/t5/Installation/Monitor-new-Splunk-admin-creation/m-p/621955#M12118 <P>Is there a way to monitor the creation of new Splunk users/admins?&nbsp;</P><P>I want to be notified if someone creates a new Splunk admin.&nbsp;</P> Thu, 24 Nov 2022 07:43:56 GMT https://community.splunk.com/t5/Installation/Monitor-new-Splunk-admin-creation/m-p/621955#M12118 anel 2022-11-24T07:43:56Z https://community.splunk.com/t5/Installation/Monitor-new-Splunk-admin-creation/m-p/621962#M12119 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/248167">@anel</a>&nbsp;<BR /><BR />you can use following query<BR /><BR /><BR />index="_audit" source=audittrail action=create_user<BR />| stats count by timestamp user info username fullname email roles default_app<BR />| rename user as "New Users Created by" username as "New User Created for"<BR /><BR /><BR />from this you will get to know who addeed new users and deatils using this you can create alert<BR /><BR /><BR /><BR /></P><P>----<BR />Regards,<BR />Sanjay Reddy</P><P>---<BR />If this reply helps you, Karma would be appreciated.</P><P>If your problem is resolved, then please click the "Accept as Solution" button to help future readers.</P> Thu, 24 Nov 2022 08:40:34 GMT https://community.splunk.com/t5/Installation/Monitor-new-Splunk-admin-creation/m-p/621962#M12119 SanjayReddy 2022-11-24T08:40:34Z