Getting Data In

How to pull a audit trail logs who made changes from so and so dates, and i want to create a alert for that.

Rocky31
Path Finder

we have like couple of admins, myself power, i want to create a alert any one of them made any changes. please share some commands, instead of links and docs.

Tags (1)
1 Solution

gokadroid
Motivator

Since the definition of anyone made any changes is vague however general changing actions shall include create, edit, change, delete keywords. The way to find these keywords for users can be done as follows:

index=_audit action=*edit* OR action=*create* OR action=*delete* OR action=*change*| stats count by user, action

There might be some other keywords like embed, restart, update etc. which you would want to consider depending on your need. This search then might be a good starting point to setup an alert on once logged in as an admin user.

View solution in original post

gokadroid
Motivator

Since the definition of anyone made any changes is vague however general changing actions shall include create, edit, change, delete keywords. The way to find these keywords for users can be done as follows:

index=_audit action=*edit* OR action=*create* OR action=*delete* OR action=*change*| stats count by user, action

There might be some other keywords like embed, restart, update etc. which you would want to consider depending on your need. This search then might be a good starting point to setup an alert on once logged in as an admin user.

Rocky31
Path Finder

Thanks for you response buddy, can i create an alert for this command. every time they made change, alert comes up. do i need to change in command. Thanks.

0 Karma

gokadroid
Motivator
index=_audit (action=*edit* OR action=*create* OR action=*delete* OR action=*change* OR action=*embed* OR action=*restart* OR action=*update*) user=admin| stats count by user, action

You have to have admin rights to search index=_audit. If you do, then above command can be saved as an alert.

Rocky31
Path Finder

I really appreciate for you concern, i have question. i created alert using above logic, but here i want alert with information with who did trigger and what he trigger all information in email. can you please help me out of this.

0 Karma

gokadroid
Motivator

When you run this search, you have an option of Save As Alert. In the Alert Trigger Actions there is an option of Add Action > Send Email > When Triggered > Include hich can be used to send the results as attachments or inline as table.

chandrasekharko
Path Finder

I created an alert and deleted an alert to try to see if the above search triggers an event. I do get results with the above query. But, not useful information like admin created an alert or deleted an alert and the alert name. Is there some query I am looking for. Is it possible on the first hand?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...