Alerting

Figuring out the user who changed last the alert

danielbb
Motivator

We would like to be alerted when an alert has been changed.

We use -

 

 

| rest /servicesNS/-/-/saved/searches 

 

This call brings back the owner but not the recent modifier id.

Is there any way to get the modifier id?

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The user that modified the alert is not recorded with the alert itself.  To find out who changed a thing, search for the thing in the audit and/or access logs.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...