Hello All,
I tried the below query and got the results as well but my concern is who is modifying, deleting or creating new alerts?
How can I search about existing alerts in my Splunk environment?
Thanks in advance!!
QUERY:
index=_internal sourcetype=splunkd_access
(method=POST OR method=DELETE)
(user!=splunk-system-user user!=-)
(uri_path=/servicesNS/* uri_path!="/user-prefs/" uri_path!="/servicesNS////jobs//control" uri_path!=/servicesNS//mobile_access )
| replace "/ui/views" with "/ui_views", "/props" with "*", "/distributed/peers*" with "/distributed_peers", "/server/serverclasses" with "/server_class" in uri_path
| where mvcount( split( uri_path , "/" ) ) > 6
| eval activity = case( method=="POST" AND like( uri_path , "%/acl" ) , "Permissions Update", method=="POST" AND NOT like( uri_path , "%/acl" ) , "Edited" , method="DELETE" , "Deleted" )
| rex field=uri_path "/servicesNS(/[^\/]+){3}/(?[^\/]+)/(?[^\/]+)"
| eval object_name = urldecode( object_name )
| table _time, user, object_name, object_type, activity|
