Building for the Splunk Platform

How to discover which user disabled and enabled the default demo lookup files in Splunk ES?

New Member

I want to see who has disabled and enabled the default demo lookup files under Splunk ES->Data Enrichment->Identity Management, is there any Search Query which can help me ?

0 Karma

Path Finder

This appears to work for me, when I test it against our own ES installation:

index="_internal" sourcetype="splunkd_access" uri="*identity_manager*" file="disable" OR file="enable"
| table _time, uri, user

It returns the username and path of what the user interacted with.

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...