https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-which-user-did-a-sudo-to-root-for/m-p/209502#M61255 <P>Try <CODE>source="/var/log/auth.log" sudo</CODE></P> Mon, 28 Dec 2015 21:30:42 GMT sundareshr 2015-12-28T21:30:42Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-which-user-did-a-sudo-to-root-for/m-p/209501#M61254 <P>Would it be something like:</P> <PRE><CODE>sourcetype="/var/log/secure" eventtype="su_authentication" </CODE></PRE> Mon, 28 Dec 2015 21:10:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-which-user-did-a-sudo-to-root-for/m-p/209501#M61254 sandyganti13 2015-12-28T21:10:03Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-which-user-did-a-sudo-to-root-for/m-p/209502#M61255 <P>Try <CODE>source="/var/log/auth.log" sudo</CODE></P> Mon, 28 Dec 2015 21:30:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-which-user-did-a-sudo-to-root-for/m-p/209502#M61255 sundareshr 2015-12-28T21:30:42Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-which-user-did-a-sudo-to-root-for/m-p/209503#M61256 <P>When i give source="/var/log/auth.log" sudo it is showing all the accounts that performed a sudo not only to ROOT but also to other ones.</P> <P>i am trying to sort out the results only to ROOT like, the accounts that did sudo su - root.</P> Tue, 29 Dec 2015 20:06:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-which-user-did-a-sudo-to-root-for/m-p/209503#M61256 sandyganti13 2015-12-29T20:06:31Z