All Apps and Add-ons

Splunk Query

mailmetoramu
Explorer

Hello All,

In one of my server the access has been given to Adam, Brian and Charlie on the host "xyxxac.bus.com".

I need to know who have added these members into that server, Please let me know the exact Splunk query.

Also i have installed Splunk UF software on this server last week only, is it possible to pull the logs from this server for last month ??

Thanks,

Ramu.R

Tags (1)
0 Karma

DavidHourani
Super Champion

Hey @mailmetoramu,

You can check who added the users by collecting windows logs of the servers. If you have AD running then you'll have to collect logs from there to get that information.

More info on collecting windows logs here :
https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/MonitorWindowseventlogdata

More info on collecting AD logs here :
https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/MonitorActiveDirectory

Cheers,
David

0 Karma

DavidHourani
Super Champion

windows server ? Linux Server ? Splunk Server ? Could you please give some details ?

0 Karma

mailmetoramu
Explorer

Windows Server actually ..!!

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...