Reporting

identities and connections question

jiaqya
Builder

on the forwarder db connect is it possible to determine the connection & operations configured for a particular identity.

for ex: if i have a identity created called " test" , can i know which all connections are using it and which all operations are configured for it via query / report.

thanks.

Tags (1)
0 Karma

nickhills
Ultra Champion

Can you add a bit more context - your question is not quite clear to me.
Can you provide examples of the data you are interested in?

If my comment helps, please give it a thumbs up!
0 Karma

jiaqya
Builder

when we create an identity on the sql db connect on the forwarder. i would like to know where all it is being used. Which connections & operations are using it.

This is basically needed for me to understand, that if i change the account password for the identity , what all reports will be impacted by this change incase the account gets locked.

previous users have created reports using this identity/connection which i have no information about .

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...