Splunk Dev

How to discover which user disabled and enabled the default demo lookup files in Splunk ES?

ishammi
New Member

I want to see who has disabled and enabled the default demo lookup files under Splunk ES->Data Enrichment->Identity Management, is there any Search Query which can help me ?

0 Karma

CMSchelin
Path Finder

This appears to work for me, when I test it against our own ES installation:

index="_internal" sourcetype="splunkd_access" uri="*identity_manager*" file="disable" OR file="enable"
| table _time, uri, user

It returns the username and path of what the user interacted with.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...