How to Root User access?

[Taibat02230232]

These are the Splunk query and it seems not working because i cant generate any request from that.

Please I need any help to be able to generate a search.

Any help would be appreciated, thanks

index=aws-cloudtrail "userIdentity.type"=Root AND NOT eventType="AwsServiceEvent"
|eval nullParentProcess=if(isnull("userIdentity.invokedBy"),true,false)
|search nullParentProcess=true
|convert ctime(_time) as _time
|stats values(dest) values(eventType) values(eventName) values(userName) latest(_time) by src
|rename values as *
|head 51

[PickleRick]

There are so many things wrong with this search...

But regardless of that, it's hard to say what the proper search should look like without knowing your data. Provide us with a sample of your events (anonymized if needed) and a description of desired results.