How to find the User ID that was used for the orig... - Splunk Community

Splunk Search

I want to upgrade a system. How do I find the ID for the user that installed it? Is it somewhere in the system?

Hello @jlongworth

you can find this information in the operating system's logs:

Windows - eventvwr.msc - installation
Linux - find the installation date and time in /var/log/yum*log or /var/log/dpgk*log and correlate it with output of last command

you can find it using splunk UI if these logs are indexed by splunk

Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...