Search to get all domain user account modifications/additions/removals?

[informatika]

Hello, new to using splunk across a domain and I am attempting to get a query that details any domain user account changes. I want to pull change type, who changed the account, and date/time from /var/log/dirsrv logs . Any suggestions?

[yuanliu]

This is a search forum.  You need to describe your data, logic, and expected output in order to get suggestions.  If you are concerned about data in a particular app, you may get better luck in All Apps and Add-ons where some people may happen to be using the same app as you do; even there, you will need to tell people which app you are concerned about.

[informatika]

edited with some more specifics! it is pertaining to search

[yuanliu]

When describing data, you really need to give details, such as which (relevant) fields are available, a general idea about values of these fields; it is perhaps easier to illustrate samples (anonymize as needed).  By describing logic, I mean how do you deduce change type and who changed the account from such data, etc. (Sometimes logic can be obvious from sample data, sometimes not, all depending on characteristics of actual data.) If you have a specific presentation format in mind, it is best to illustrate, too. (None of these are obvious from your question.)