Security

Which log would have the info about user creation?

anoopambli
Communicator

Hi,

I have added couple of users in splunk using command line option. After few days few of them came back to me with login issue. I wanted to check in the log and find out whether those users were really added. Which log would have the info about user creation?

Labels (1)
Tags (1)
0 Karma

ngohel
Engager

I have used the following query which shows the list of users created along with user details.

 

(index=_audit sourcetype=audittrail action=create_user )
| table _time action info username roles user fullname email
| rename user AS CreatedBy

0 Karma

somesoni2
Revered Legend

It should be present in the _audit index.

Sample query:

index=_audit object=<newUserName>
0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...