Splunk Search

How can I get Membership information?

risingflight143
Explorer

Hi All

i have an unified group(i.e office365 unified group) created from Office365.  i want to know membership details i.e who has added/removed users to this group. This group will also be visible in Azure AD. i can check audit logs in Azure AD and it shows only for a month. i am trying below splunk query to fetch membership information from both Azure AD and office365 but i am not getting output. ug@contoso.com is my group  name

 

 

sourcetype=azure*:management:activity (Operation="*Change user*" OR Operation="*Update user*") ObjectId="*ug@contoso.com*" (UserId!="Certificate" AND UserId!="ServicePrincipal*" AND UserId!="Sync*") (ModifiedProperties{}.NewValue!=" " AND ModifiedProperties{}.OldValue!=" ")
| rename ModifiedProperties{}.NewValue AS ModAdd
| rename ModifiedProperties{}.OldValue AS ModRem
| rename UserId AS "Actioned By" 
| rename Operation AS "Action" 
| rename ObjectId AS "Member"
| sort -_time 
| table _time, ModAdd, ModRem, "Action", Member, "Actioned By"

 

 

 

 

 

 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

To obtain help from volunteers, you will first need to post sample data (anonymize as needed) that can support your belief that the search should return output.  If the logic is not obvious, you also need to explain your logic between raw data and your expected output.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...