Splunk Searches | A collection of useful Splunk SPL

Splunk Search for Splunk user modification attempts Copy


				index=_audit sourcetype=audittrail action=edit_user | eval Date=strftime(_time, "%b %d, %Y") |where user!=object| stats count by user, info, object, Date | rename user as User | rename info as "Status" | rename object as "Target Account" | sort - count

0 comments

[0]