Solved: Re: Which capabilities has a user used?

Moldy · ‎07-12-2024

Trying to create a search that will show which capabilities a user has used within the last year.

richgalloway · ‎07-12-2024

Capability use is not logged. Actions performed by users are logged in _audit. It would be up to you map those actions to the associated capabilities.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Moldy · ‎07-12-2024

Thank you!

richgalloway · ‎07-12-2024

Capability use is not logged. Actions performed by users are logged in _audit. It would be up to you map those actions to the associated capabilities.

---
If this reply helps you, Karma would be appreciated.

Which capabilities has a user used?

access control

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Guided Onboarding with Auto-schema Is Now Generally Available

ATTENTION: We’re Moving! (AGAIN!)

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

Join the Conversation