All Apps and Add-ons

How to create a search that shows all users that have reset their password at a certain time and date?

mailmetoramu
Explorer

Hello All,

Need a Splunk query that show all users who’ve reset their password since 4/15 @ 11am ET.

Thanks,

Ramu.R

0 Karma

jeffland
SplunkTrust
SplunkTrust

This should find successful password changes. user will be the user that initiated the change, object will be the user that was changed.

index=_audit action="password change" info=succeeded
0 Karma

mailmetoramu
Explorer

Not working ..!!

0 Karma

jeffland
SplunkTrust
SplunkTrust

That's too little info. What exactly did you do, and what happened? The search doesn't run? It doesn't return any results? It doesn't return the expected results? You should at least check the following: do you have the permissions to access _audit? Are you on a distributed environment and is the content of _audit forwarded to your indexers?

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...