When I run a report of roles that have been modified in our splunk cloud instance I see these entries
Date Time user action info role_name
04-06-20 16:50:18 _ops_admin edit_user granted _ops_admin
04-06-20 16:50:15 _ops_admin edit_user granted _ops_admin
04-06-20 16:49:52 _ops_admin edit_user granted _ops_admin
04-06-20 16:44:06 _ops_admin edit_user granted _ops_admin
04-06-20 16:44:03 _ops_admin edit_user granted _ops_admin
We dont have that user or role name defined in our instance. Anyone have an idea of what this is and if I should be concerned?
Values beginning with "_" are often reserved by Splunk. Perhaps this is a user/role Splunk uses to manage your Cloud instances.