All Apps and Add-ons

How to create a search that shows all users that have reset their password at a certain time and date?

Explorer

Hello All,

Need a Splunk query that show all users who’ve reset their password since 4/15 @ 11am ET.

Thanks,

Ramu.R

0 Karma

Champion

This should find successful password changes. user will be the user that initiated the change, object will be the user that was changed.

index=_audit action="password change" info=succeeded
0 Karma

Explorer

Not working ..!!

0 Karma

Champion

That's too little info. What exactly did you do, and what happened? The search doesn't run? It doesn't return any results? It doesn't return the expected results? You should at least check the following: do you have the permissions to access _audit? Are you on a distributed environment and is the content of _audit forwarded to your indexers?

0 Karma