Alerting

Out of 10-15 users with permission, can we identify who disabled an alert?

akchauhan
Explorer

We had created alert to catch error in logs and gave permission to group(10-15 users) to edit alert but someone disabled alert due to which alert didn't trigger. Just wanted to check if there is any way to find user who had disabled alert?

0 Karma

HiroshiSatoh
Champion

Determine when the alert was not executed. Then, check the user who logged in at that time.

It seems that it can be monitored by setting it.

https://answers.splunk.com/answers/448625/how-to-monitor-changes-made-to-the-inputsconf-file.html

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...