Splunk query to check which user disabled/enabled alert.
See what is in the logs like this:
index=_audit "disabled alert name here"
not sure @woodcock if the new version updated the audit log formats/my old 7.3 does not have yet your search query format,.. but i created a test alert and disabled and queried the audit index, but no match. something fishy.
We have a report built in splunk that runs whenever any alert is disabled by a user in splunk. I want to find the user who has disabled the alert.Is this doable?
Has this been answered... I am looking for the same thing as to WHO has done what?
Hi @cmeisch
you can with following query
index="_internal" sourcetype="splunkd_ui_access" file IN (disable,enable)
i tried enable/disbale one of saved it , enable disable logs are showing with username who did that action
Thanks for the response. What I am trying to do is to see when a rule has been enabled\disabled and by who. I Your suggestion will give me who has disabled\enabled but I am trying to figure out what was enabled\disabled... BUT I am closer thanks to you!
Hi @cmeisch
index="_internal" sourcetype="splunkd_ui_access" file IN (disable,enable)
| table _time user uri file
I am not good at regex😁, but hightlited the savedsearch name on which action done ,
after searches/ word is the report/alert name followed by action
---
If this reply helps you, an upvote/Karma would be appreciated.
Oh my god finally, someone found it. Here is a revised query that works a little better and shows the "files" (searches) enabled by a particular user and decodes them to make them easier to read.
index="_internal" sourcetype=splunkd_ui_access method=POST
| eval file=urldecode(file)
| stats values(file) by user
Care to elaborate?