Hi, Can you provide a sample of your data and the expected result please? Can you share the return of your SPL request too please? Best regards, Adrian ... View more

See if below links can help you. There are many related answers in the 1st link https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/MonitorActiveDirectory https://answers.splunk.com/answers/216884/monitoring-active-directory-groups-is-it-possible.html ... View more

Hi @corecomputetools, If you're talking about AWS security groups then have a look here : "You can layer Config, CloudTrail, and CloudWatch Events on top of Amazon VPC security groups to provide a defense-in-depth approach to security. Though VPC security groups provide critical filtering capabilities, Config rules, CloudTrail, and CloudWatch Events take the protection to a deeper level by monitoring security groups and notifying you of potentially unintended changes." https://aws.amazon.com/blogs/security/how-to-monitor-aws-account-configuration-changes-and-api-calls-to-amazon-ec2-security-groups/ If you're talking about Splunk roles then you can use the following REST endpoint to craft a search that fetches specifically the roles and users you wish to monitor : | rest services/authorization/roles Let me know if that helps. Cheers, David ... View more

Most welcome, use the tstats when trying to access metadata and display a count by index, host or even sourcetype. Let me know if you're getting faster results with this search 🙂 ... View more