Solved: Which capabilities has a user used?

Moldy · ‎07-12-2024

Trying to create a search that will show which capabilities a user has used within the last year.

richgalloway · ‎07-12-2024

Capability use is not logged. Actions performed by users are logged in _audit. It would be up to you map those actions to the associated capabilities.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Moldy · ‎07-12-2024

Thank you!

richgalloway · ‎07-12-2024

Capability use is not logged. Actions performed by users are logged in _audit. It would be up to you map those actions to the associated capabilities.

---
If this reply helps you, Karma would be appreciated.

Which capabilities has a user used?

access control

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Federated Search for Dynamic Data Self Storage Is Now Generally Available on Splunk ...

Index This | What has many keys but can’t unlock a door?

Join the Conversation