To best of my knowledge only Admins can add Index or Indexer correct? I am having tough time to create an alert to see who adds new index or Indexers to my Splunk Enterprise or ES. Your help is appreciated in advance.
Well if someone has the access to modify your indexes.conf yes, they can add an index.
Adding another indexer to your Splunk deployment requires them to know your Pass4SymmKey. Without that, they can't add an indexer to your Splunk servers.
