https://community.splunk.com/t5/Splunk-Search/How-to-find-who-executed-delete-event-command/m-p/218815#M64312 <P>Duplicate:</P> <P><A href="https://answers.splunk.com/answers/43339/alert-on-deleted-data.html">https://answers.splunk.com/answers/43339/alert-on-deleted-data.html</A></P> Wed, 04 Nov 2015 17:33:07 GMT aljohnson_splun 2015-11-04T17:33:07Z https://community.splunk.com/t5/Splunk-Search/How-to-find-who-executed-delete-event-command/m-p/218814#M64311 <P>Need your help,</P> <P>Can you please provide the splunk query to find who are all executed delete event command (| delete) in last one hour. because if someone delete the event, we want to know the user details and what query they executed.</P> Wed, 04 Nov 2015 16:49:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-who-executed-delete-event-command/m-p/218814#M64311 dhavamanis 2015-11-04T16:49:40Z https://community.splunk.com/t5/Splunk-Search/How-to-find-who-executed-delete-event-command/m-p/218815#M64312 <P>Duplicate:</P> <P><A href="https://answers.splunk.com/answers/43339/alert-on-deleted-data.html">https://answers.splunk.com/answers/43339/alert-on-deleted-data.html</A></P> Wed, 04 Nov 2015 17:33:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-who-executed-delete-event-command/m-p/218815#M64312 aljohnson_splun 2015-11-04T17:33:07Z