Installation

Monitor new Splunk admin creation

anel
Explorer

Is there a way to monitor the creation of new Splunk users/admins? 

I want to be notified if someone creates a new Splunk admin. 

Labels (2)
0 Karma
1 Solution

SanjayReddy
SplunkTrust
SplunkTrust

Hi @anel 

you can use following query


index="_audit" source=audittrail action=create_user
| stats count by timestamp user info username fullname email roles default_app
| rename user as "New Users Created by" username as "New User Created for"


from this you will get to know who addeed new users and deatils using this you can create alert



----
Regards,
Sanjay Reddy

---
If this reply helps you, Karma would be appreciated.

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

View solution in original post

SanjayReddy
SplunkTrust
SplunkTrust

Hi @anel 

you can use following query


index="_audit" source=audittrail action=create_user
| stats count by timestamp user info username fullname email roles default_app
| rename user as "New Users Created by" username as "New User Created for"


from this you will get to know who addeed new users and deatils using this you can create alert



----
Regards,
Sanjay Reddy

---
If this reply helps you, Karma would be appreciated.

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...