https://community.splunk.com/t5/Monitoring-Splunk/Splunk-Audit/m-p/461179#M3878 <P>Hi, last week, I had full administrative access with Splunk but opened Splunk this morning and it appears my role may have changed; I now have what appears to be limited visibility into the Settings menu, something to that a normal end-user role might see. Looking for some SPL that would detect if changes were made to my account, when those changes were made, what changes were made, and who made those changes. Any help with this is appreciated.</P> Fri, 05 Jun 2020 23:24:45 GMT itsmevic 2020-06-05T23:24:45Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-Audit/m-p/461179#M3878 <P>Hi, last week, I had full administrative access with Splunk but opened Splunk this morning and it appears my role may have changed; I now have what appears to be limited visibility into the Settings menu, something to that a normal end-user role might see. Looking for some SPL that would detect if changes were made to my account, when those changes were made, what changes were made, and who made those changes. Any help with this is appreciated.</P> Fri, 05 Jun 2020 23:24:45 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-Audit/m-p/461179#M3878 itsmevic 2020-06-05T23:24:45Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-Audit/m-p/461180#M3879 <P>You can search the _audit index for user changes.</P> <PRE><CODE>index=_audit sourcetype=audittrail action=edit_user </CODE></PRE> <P>Then you can specify a user that you are looking for or the "object" that was changed.</P> <P>example output:</P> <PRE><CODE>Audit:[timestamp=04-01-2020 05:08:32.013, user=zona, action=edit_user, info=granted object="james" operation=edit][n/a] Audit:[timestamp=04-01-2020 05:08:32.013, user=zona, action=edit_user, info=succeeded object="james" password_changed=false realname="james johnson" email="test@test.com" roles="admin+power+user" password_state="" unlock_user=1 , default_app="launcher", ji=""][n/a] </CODE></PRE> Wed, 01 Apr 2020 05:25:58 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-Audit/m-p/461180#M3879 zacharychristen 2020-04-01T05:25:58Z