My current search looks like this:
index=smt_gsuite sourcetype=gapps:report:drive "events{}.name"=change_user_access | stats count by actor.email,events{}.parameters{}.owner,events{}.parameters{}.target_user
This query seems to show me the person who initiated the access change, the owner of the file and the user who now has access to the file.
What I cant seem to figure out how to do is specifically write a search that shows "ownership changes" to files not just access changes.
Has anyone used the gsuite for splunk app and been able to write a search that shows ownership changes?
