Hey I'm new to splunk and I'm having problems finding specific events for a local server, I need help to search for the following:
i. Successful and unsuccessful access to log files
ii. Successful and unsuccessful authentication events
iii. Successful and unsuccessful authorization events
iv. Successful and unsuccessful resource access events
v. Successful and unsuccessful privilege operation
vi. Creation modification and deletion of user accounts, group accounts and objects including files, directories and user accounts.
vii. Creation, modification and deletion of command line changes, batch file changes and queries made to databases.
viii. Creation, modification and deletion of security policy.
ix. Changes to logical access control authority (i.e. rights permission).
x. System and/or application shutdowns, reboots/restarts, errors.
xi. All system changes with the potential to compromise the integrity of the audit policy configurations and audit record generation services.
