Is it possible to get user details from the _configtracker index?

[ewanbrown967]

Hello

I've been looking at the new _configtracker index and I would like to know how I could get the User details associated with the configuration change.

Regards

[richgalloway · Accepted solution]

You can't.  Splunk doesn't identify the user who made the change.

[ewanbrown967]

That's kind of what I expected.  Hopefully, it will come in the next release.

Many thank for your reply, @richgalloway 

[richgalloway]

We've been hoping for that for a long time now.  🙂  Add your voice at https://ideas.splunk.com