Monitor new Splunk admin creation

[anel]

Is there a way to monitor the creation of new Splunk users/admins? 

I want to be notified if someone creates a new Splunk admin. 

[SanjayReddy · Accepted solution]

Hi @anel 

you can use following query


index="_audit" source=audittrail action=create_user
| stats count by timestamp user info username fullname email roles default_app
| rename user as "New Users Created by" username as "New User Created for"


from this you will get to know who addeed new users and deatils using this you can create alert

----
Regards,
Sanjay Reddy

---
If this reply helps you, Karma would be appreciated.

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.