How to write a search to find which user did a sudo to root for the last 2 days on Linux servers?

[sandyganti13]

Would it be something like:

sourcetype="/var/log/secure" eventtype="su_authentication"

[sundareshr]

Try source="/var/log/auth.log" sudo

[sandyganti13]

When i give source="/var/log/auth.log" sudo it is showing all the accounts that performed a sudo not only to ROOT but also to other ones.

i am trying to sort out the results only to ROOT like, the accounts that did sudo su - root.