https://community.splunk.com/t5/Splunk-Search/how-to-search-for-admins-who-make-changes-to-their-own-accounts/m-p/703613#M238473 <P>was able to figure it out!</P> <P>needed to just use an IF statement.&nbsp;</P> <LI-CODE lang="markup">| eval testuser=if(admin=target,1,0) | where testuser=1</LI-CODE> Tue, 05 Nov 2024 20:10:21 GMT ajmach343 2024-11-05T20:10:21Z https://community.splunk.com/t5/Splunk-Search/how-to-search-for-admins-who-make-changes-to-their-own-accounts/m-p/703608#M238470 <P>I am trying to make a search that will fire only when an admin makes a change to their own account.</P><P>I want to know if a-johndoe gives multiple permissions to a-johndoe and NOT if a-johndoe gives permissions to a-janedoe.&nbsp;</P><P>would i use an IF statement for this?</P><P>&nbsp;</P><P>Thank you</P> Tue, 05 Nov 2024 15:19:17 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-for-admins-who-make-changes-to-their-own-accounts/m-p/703608#M238470 ajmach343 2024-11-05T15:19:17Z https://community.splunk.com/t5/Splunk-Search/how-to-search-for-admins-who-make-changes-to-their-own-accounts/m-p/703611#M238471 <P>What data are you talking about?</P><P>Splunk account changes? Windows Event Logs? Some (what) Linux audit logs?</P><P>If your data is CIM-normalized, you should use Change.Account_Management dataset.</P> Tue, 05 Nov 2024 15:25:44 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-for-admins-who-make-changes-to-their-own-accounts/m-p/703611#M238471 PickleRick 2024-11-05T15:25:44Z https://community.splunk.com/t5/Splunk-Search/how-to-search-for-admins-who-make-changes-to-their-own-accounts/m-p/703612#M238472 <P>apologies, this will be for windows event logs and Ivanti logs.&nbsp;<BR /><BR /></P> Tue, 05 Nov 2024 15:32:01 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-for-admins-who-make-changes-to-their-own-accounts/m-p/703612#M238472 ajmach343 2024-11-05T15:32:01Z https://community.splunk.com/t5/Splunk-Search/how-to-search-for-admins-who-make-changes-to-their-own-accounts/m-p/703613#M238473 <P>was able to figure it out!</P> <P>needed to just use an IF statement.&nbsp;</P> <LI-CODE lang="markup">| eval testuser=if(admin=target,1,0) | where testuser=1</LI-CODE> Tue, 05 Nov 2024 20:10:21 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-for-admins-who-make-changes-to-their-own-accounts/m-p/703613#M238473 ajmach343 2024-11-05T20:10:21Z