Need help forming search string to show when users create new users

[jcorkey]

I have a linux box with a universal forwarder sending linux data to my Splunk enterprise. I am trying to detect when a user creates another user by running useradd User2
Below is my search string:

index=main host=myhost useradd

This gives me the logs I want but how do I know the username of the user that created the new user?

For example. User1 creates User2....The logs show that User2 was created but it only shows the uid of User1 who did the creating and it does not tell me the actual username which should be User1.

How do I get the username of the user who creates new users??

[woodcock]

Use a cron like this:

01 23 * * * * /bin/cat /etc/passwd | /bin/awk -F: 'BEGIN {OFS=","; print "UID,login,FullName"} {print $3,$1,$5}' > /tmp/eraseme.csv && /bin/cat /tmp/splunk_user_lookup.csv /tmp/eraseme.csv | sort -ru > /tmp/eraseme2.csv && /bin/mv -f /tmp/eraseme2.csv /tmp/splunk_user_lookup.csv && /bin/scp Your scp stuff here to copy this to your Search Head or Deployer or Deployment Server and run reload deploy-server or whatever too if you need to

[s2_splunk]

If you don't already have the mapping somewhere in Splunk, you could create a scripted input that executes cat /etc/passwd at a reasonable frequency and index those results with proper field extractions. You can then either create a lookup table from that with a scheduled search (run once a day to update?) or use a subsearch.