How to find the User ID that was used for the orig... - Splunk Community

Splunk Search

I want to upgrade a system. How do I find the ID for the user that installed it? Is it somewhere in the system?

Hello @jlongworth

you can find this information in the operating system's logs:

Windows - eventvwr.msc - installation
Linux - find the installation date and time in /var/log/yum*log or /var/log/dpgk*log and correlate it with output of last command

you can find it using splunk UI if these logs are indexed by splunk

Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...