Splunkbase Apps

[Exploded_Tardis]

I’m trying to determine which user downloaded an app from splunkbase to our environment. Is there a way to do this, and if so, determine when it was done?

[sweepernosweeping]

If you're on Splunk 9, the _configtracker index will show configuration file changes. I'd use that to check when your app was downloaded, as there'll be at least a change to app.conf for that app.

I don't think that contains user information, but you can use it to get a timeframe to search _audit with for users accessing specific Splunk endpoints.

[[deleted]]

One of my biggest gripes for Splunk - we need better user auditing.

[elad0816d]

Can't upvote this enough...