Auditing who disabled/enabled alerts on a Search Head

[jeffbat]

I am trying to figure out how I can audit who disabled alerts on one of our search heads. I was thinking it is in the _audit index but have not been able to find the information I would expect.

I have enabled the alerts again as they need to be running but I do not see an entry in audit that shows I did that even.

This is likely just a search that I am not writing correctly.

Does anyone have a search that will show me alerts that were enabled/disabled during a time period and what user performed the action?

Thanks.

[richgalloway]

_audit doesn't have as much information as one would expect. Try looking in splunkd_ui_access.log.

[inventsekar]

Hi @richgalloway 

splunkd_ui_access.log also does not have good info.. something missing, something fishy.

[jeffbat]

I am not seeing in there what user that has made a change to the specific alert. (I did see the time window where I enabled a search that was disabled but it doesn't show my account doing it, and it was only showing it through the scheduler sourcetype as that meant it got rescheduled. The only user shown is the user that the alert was created with).

This does help me narrow down when it was changed to disabled but now who did it.